[GH-ISSUE #328] How to easily use private-bin

gitea-mirror commented

2026-05-05 05:21:59 -06:00

Owner

Originally created by @chiraag-nataraj on GitHub (Feb 27, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/328

I'm trying to further lock down Firefox beyond the default profile. I've already used private-tmp and private-etc as well as only allowing certain directories and files in my home directory using whitelist. My next hope was to further restrict what firefox is able to do using private-bin. I tried only whitelisting firefox, iceweasel (this is a Debian system), sh, and which and now, while firefox tries to start up, it gives me a /usr/bin/libxul.so not found which makes sense (libxul.so is in /usr/lib, not /usr/bin). I guess all this is a long-winded way of asking how I can figure out which binaries are required by iceweasel/firefox so I can whitelist only those binaries. None of the current trace/debug options give enough info for this as far as I can tell.

Originally created by @chiraag-nataraj on GitHub (Feb 27, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/328 I'm trying to further lock down Firefox beyond the default profile. I've already used `private-tmp` and `private-etc` as well as only allowing certain directories and files in my home directory using `whitelist`. My next hope was to further restrict what firefox is able to do using `private-bin`. I tried only whitelisting `firefox`, `iceweasel` (this is a Debian system), `sh`, and `which` and now, while firefox tries to start up, it gives me a `/usr/bin/libxul.so not found` which makes sense (`libxul.so` is in `/usr/lib`, not `/usr/bin`). I guess all this is a long-winded way of asking how I can figure out which binaries are required by iceweasel/firefox so I can whitelist only those binaries. None of the current trace/debug options give enough info for this as far as I can tell.

gitea-mirror

2026-05-05 05:21:59 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:22:07 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 27, 2016):

I am on Debian 8 here. In a terminal I run "sudo firemon". This prints out all processes forked by your application in the sandbox. In another terminal I start "firejail /usr/lib/iceweasel/iceweasel". This is what I get in firemon terminal:

08:50:32 uid  13525 (root) NEW SANDBOX: firejail /usr/lib/iceweasel/iceweasel 
08:50:32 exec 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
08:50:32 uid  13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
08:50:32 uid  13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
08:50:32 uid  13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
08:50:32 uid  13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
08:50:32 uid  13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
08:50:32 uid  13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
08:50:32 uid  13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
08:50:32 uid  13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
08:50:32 fork 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
    child 13526 firejail /usr/lib/iceweasel/iceweasel 
08:50:32 uid  13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
08:50:32 uid  13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
08:50:32 uid  13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
08:50:32 uid  13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
08:50:32 uid  13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
08:50:32 uid  13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
08:50:32 uid  13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
08:50:32 uid  13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 
08:50:32 fork 13526 (netblue) firejail /usr/lib/iceweasel/iceweasel 
    child 13527
08:50:32 uid  13527 (netblue) /bin/bash -c "/usr/lib/iceweasel/iceweasel"  
08:50:32 exec 13527 (netblue) /bin/bash -c "/usr/lib/iceweasel/iceweasel"  
08:50:32 exec 13527 (netblue) /usr/lib/iceweasel/iceweasel 
08:50:32 fork 13527 (netblue) /usr/lib/iceweasel/iceweasel 
    child 13529 /usr/lib/iceweasel/iceweasel

It looks like the only thing I need from /bin is bash. I close firefox window and I start again, this time using private-bin:

$ firejail --private-bin=bash /usr/lib/iceweasel/iceweasel

Play some youtube videos, just in case it requires some other executables in /bin - you'll find them listed in firemon window.

@netblue30 commented on GitHub (Feb 27, 2016): I am on Debian 8 here. In a terminal I run "sudo firemon". This prints out all processes forked by your application in the sandbox. In another terminal I start "firejail /usr/lib/iceweasel/iceweasel". This is what I get in firemon terminal: ``` 08:50:32 uid 13525 (root) NEW SANDBOX: firejail /usr/lib/iceweasel/iceweasel 08:50:32 exec 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 08:50:32 uid 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 08:50:32 uid 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 08:50:32 uid 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 08:50:32 uid 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 08:50:32 uid 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 08:50:32 uid 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 08:50:32 uid 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 08:50:32 uid 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 08:50:32 fork 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel child 13526 firejail /usr/lib/iceweasel/iceweasel 08:50:32 uid 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 08:50:32 uid 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 08:50:32 uid 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 08:50:32 uid 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 08:50:32 uid 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 08:50:32 uid 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 08:50:32 uid 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 08:50:32 uid 13525 (netblue) firejail /usr/lib/iceweasel/iceweasel 08:50:32 fork 13526 (netblue) firejail /usr/lib/iceweasel/iceweasel child 13527 08:50:32 uid 13527 (netblue) /bin/bash -c "/usr/lib/iceweasel/iceweasel" 08:50:32 exec 13527 (netblue) /bin/bash -c "/usr/lib/iceweasel/iceweasel" 08:50:32 exec 13527 (netblue) /usr/lib/iceweasel/iceweasel 08:50:32 fork 13527 (netblue) /usr/lib/iceweasel/iceweasel child 13529 /usr/lib/iceweasel/iceweasel ``` It looks like the only thing I need from /bin is bash. I close firefox window and I start again, this time using private-bin: ``` $ firejail --private-bin=bash /usr/lib/iceweasel/iceweasel ``` Play some youtube videos, just in case it requires some other executables in /bin - you'll find them listed in firemon window.

gitea-mirror commented

2026-05-05 05:22:09 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 27, 2016):

At some point playing with it I also get:

08:54:55 exec 13868 (netblue) sh -c ps x | grep netscape 
08:54:55 fork 13868 (netblue) sh -c ps x | grep netscape 
    child 13869 sh -c ps x | grep netscape 
08:54:55 fork 13868 (netblue) sh -c ps x | grep netscape 
    child 13870 sh -c ps x | grep netscape 
08:54:55 exec 13870 (netblue) grep netscape 
08:54:55 exec 13869 (netblue) ps x

This means I need to add ps, grep, and sh to the list:

$ firejail --private-bin=bash,ps,grep,sh /usr/lib/iceweasel/iceweasel

@netblue30 commented on GitHub (Feb 27, 2016): At some point playing with it I also get: ``` 08:54:55 exec 13868 (netblue) sh -c ps x | grep netscape 08:54:55 fork 13868 (netblue) sh -c ps x | grep netscape child 13869 sh -c ps x | grep netscape 08:54:55 fork 13868 (netblue) sh -c ps x | grep netscape child 13870 sh -c ps x | grep netscape 08:54:55 exec 13870 (netblue) grep netscape 08:54:55 exec 13869 (netblue) ps x ``` This means I need to add ps, grep, and sh to the list: ``` $ firejail --private-bin=bash,ps,grep,sh /usr/lib/iceweasel/iceweasel ```

gitea-mirror commented

2026-05-05 05:22:12 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Feb 27, 2016):

Awesome thanks!

@chiraag-nataraj commented on GitHub (Feb 27, 2016): Awesome thanks!

gitea-mirror commented

2026-05-05 05:22:15 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Feb 27, 2016):

I just tried using firemon and this is the output I get (at the beginning):

09:41:20 uid  25080 (chiraag) /bin/sh /usr/bin/firefox 
09:41:20 exec 25080 (chiraag) /bin/sh /usr/bin/firefox 
09:41:20 fork 25080 (chiraag) /bin/sh /usr/bin/firefox 
    child 25081 /bin/sh /usr/bin/firefox 
09:41:20 exec 25081 (chiraag) /bin/sh /usr/bin/which /usr/bin/firefox 
09:41:20 exit 25081 (chiraag)
09:41:20 exec 25080 (chiraag) iceweasel 
09:41:20 fork 25080 (chiraag) iceweasel 
    child 25083 iceweasel 
09:41:20 exit 25083 (chiraag)
09:41:20 fork 25080 (chiraag) iceweasel 
    child 25114 iceweasel 
09:41:20 exec 25114 (chiraag) dbus-launch --autolaunch 33ef9f252dda82b147eebe6f5324ddb4 --binary-syntax --close-stderr 
09:41:20 exit 25114 (chiraag)
09:41:21 fork 25080 (chiraag) iceweasel 
    child 25144 iceweasel 
09:41:21 exec 25144 (chiraag) dbus-launch --autolaunch=33ef9f252dda82b147eebe6f5324ddb4 --binary-syntax --close-stderr 
09:41:21 exit 25144 (chiraag)
09:41:22 fork 25080 (chiraag) iceweasel 
    child 25232 iceweasel 
09:41:22 exec 25232 (chiraag) /bin/sh -c test -n "$DISPLAY" 
09:41:22 exit 25232 (chiraag)
09:41:22 fork 25080 (chiraag) iceweasel 
    child 25235 iceweasel

and then it continues with other things. The thing is just whitelisting /bin/sh, /usr/bin/which, /usr/bin/dbus-launch, /usr/bin/firefox, and /usr/bin/iceweasel isn't enough for some reason. It's now giving a different error saying "Unable to find Mozilla runtime".

@chiraag-nataraj commented on GitHub (Feb 27, 2016): I just tried using firemon and this is the output I get (at the beginning): ``` 09:41:20 uid 25080 (chiraag) /bin/sh /usr/bin/firefox 09:41:20 exec 25080 (chiraag) /bin/sh /usr/bin/firefox 09:41:20 fork 25080 (chiraag) /bin/sh /usr/bin/firefox child 25081 /bin/sh /usr/bin/firefox 09:41:20 exec 25081 (chiraag) /bin/sh /usr/bin/which /usr/bin/firefox 09:41:20 exit 25081 (chiraag) 09:41:20 exec 25080 (chiraag) iceweasel 09:41:20 fork 25080 (chiraag) iceweasel child 25083 iceweasel 09:41:20 exit 25083 (chiraag) 09:41:20 fork 25080 (chiraag) iceweasel child 25114 iceweasel 09:41:20 exec 25114 (chiraag) dbus-launch --autolaunch 33ef9f252dda82b147eebe6f5324ddb4 --binary-syntax --close-stderr 09:41:20 exit 25114 (chiraag) 09:41:21 fork 25080 (chiraag) iceweasel child 25144 iceweasel 09:41:21 exec 25144 (chiraag) dbus-launch --autolaunch=33ef9f252dda82b147eebe6f5324ddb4 --binary-syntax --close-stderr 09:41:21 exit 25144 (chiraag) 09:41:22 fork 25080 (chiraag) iceweasel child 25232 iceweasel 09:41:22 exec 25232 (chiraag) /bin/sh -c test -n "$DISPLAY" 09:41:22 exit 25232 (chiraag) 09:41:22 fork 25080 (chiraag) iceweasel child 25235 iceweasel ``` and then it continues with other things. The thing is just whitelisting `/bin/sh`, `/usr/bin/which`, `/usr/bin/dbus-launch`, `/usr/bin/firefox`, and `/usr/bin/iceweasel` isn't enough for some reason. It's now giving a different error saying "Unable to find Mozilla runtime".

gitea-mirror commented

2026-05-05 05:22:18 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Feb 27, 2016):

Could this be because /usr/bin/iceweasel is a symbolic link to /usr/lib/iceweasel/iceweasel?

@chiraag-nataraj commented on GitHub (Feb 27, 2016): Could this be because /usr/bin/iceweasel is a symbolic link to /usr/lib/iceweasel/iceweasel?

gitea-mirror commented

2026-05-05 05:22:21 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Feb 27, 2016):

Yeah, that's why this is happening. Basically, since /usr/bin/iceweasel -> /usr/lib/iceweasel/iceweasel, firejail is getting confused. Is there a workaround for this at the moment besides manually calling /usr/lib/iceweasel/iceweasel instead of /usr/bin/firefox? I guess I could just add /usr/lib/iceweasel/ to the path or something or hard-link /usr/lib/iceweasel/iceweasel to /usr/bin/iceweasel.

@chiraag-nataraj commented on GitHub (Feb 27, 2016): Yeah, that's why this is happening. Basically, since `/usr/bin/iceweasel -> /usr/lib/iceweasel/iceweasel`, firejail is getting confused. Is there a workaround for this at the moment besides manually calling /usr/lib/iceweasel/iceweasel instead of /usr/bin/firefox? I guess I could just add /usr/lib/iceweasel/ to the path or something or hard-link /usr/lib/iceweasel/iceweasel to /usr/bin/iceweasel.

gitea-mirror commented

2026-05-05 05:22:26 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Feb 27, 2016):

Sorry for all the comments, but just wanted to comment as to how I resolved this finally.
Since the /usr/bin/firefox script checks for the existence of /usr/bin/firefox.real, I set up a shell script that just calls /usr/lib/iceweasel/iceweasel and put it in that location. Now I can use private-bin and just use firejail firefox!

@chiraag-nataraj commented on GitHub (Feb 27, 2016): Sorry for all the comments, but just wanted to comment as to how I resolved this finally. Since the `/usr/bin/firefox` script checks for the existence of `/usr/bin/firefox.real`, I set up a shell script that just calls `/usr/lib/iceweasel/iceweasel` and put it in that location. Now I can use private-bin _and_ just use `firejail firefox`!

gitea-mirror commented

2026-05-05 05:22:28 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 27, 2016):

Or you can just add a shell script as /usr/local/bin/iceweasel, and then you just type "iceweasel". It also works with you desktop environment menus. I am using something like this:

$ cat /usr/local/bin/iceweasel
#!/bin/bash
firejail --name=browser --net=eth0 --private-bin=bash,sh,ps,grep,test,kde4-config /usr/lib/iceweasel/iceweasel "$@"

@netblue30 commented on GitHub (Feb 27, 2016): Or you can just add a shell script as /usr/local/bin/iceweasel, and then you just type "iceweasel". It also works with you desktop environment menus. I am using something like this: ``` $ cat /usr/local/bin/iceweasel #!/bin/bash firejail --name=browser --net=eth0 --private-bin=bash,sh,ps,grep,test,kde4-config /usr/lib/iceweasel/iceweasel "$@" ```

gitea-mirror commented

2026-05-05 05:22:30 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Feb 27, 2016):

Ah...yeah, I guess that works too. I guess I like explicitly knowing when I'm sandboxing something.

@chiraag-nataraj commented on GitHub (Feb 27, 2016): Ah...yeah, I guess that works too. I guess I like explicitly knowing when I'm sandboxing something.

Rows
Columns

[GH-ISSUE #328] How to easily use private-bin #231