mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3693] Kate - Read/Write problems in /home/ (ignores overrides?) #2327
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2327
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Utini2000 on GitHub (Oct 24, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3693
Bug and expected behavior
Kate can't write into .zshrc or access most of the files/folders in /.config/
I also made a file /home/username/.config/firejail/kate.local:
noblacklist ${HOME}/.config noblacklist ${HOME}/.config/ noblacklist ${HOME}/.zshrcNo profile and disabling firejail
firejail --noprofile /path/to/programin a terminal?Then everything works just fine
which <program>orfirejail --listwhile the sandbox is running)?/usr/local/bin/kate
Reproduce
Steps to reproduce the behavior:
Environment
Additional context
Basically I want to have kate to run under all the standard rules from /etc/firejail/kate.profile while adding 2-3 rules by myself that override the stock profile (e.g. allowing to edit anything in /home/user/.config/)
Checklist
https://github.com/netblue30/firejail/issues/1139)--profile=PROFILENAMEis used to set the right profile.debug output
@rusty-snake commented on GitHub (Oct 24, 2020):
It is not possible to add a
noblacklist ${HOME}/.config.noblacklistmust match theblacklistpath.You can (1) add a
noblacklist ${HOME}/…for all the things you need or (2)ignore include disable-programs.inc(or comment it). If you want to edit .zshrc you need to do the same fordisable-common.inc. The blacklist for$HOME/.config/firejailis hardcoded and can not be overriden.@Utini2000 commented on GitHub (Oct 24, 2020):
Thank you a lot @rusty-snake
putting "ignore include disable-programs.inc" into my "/.config/firejail/kate.local" worked fine.
How ever, I would rather no do the same with the whole "disable-common.inc" just to enable .zshrc editing.
Is there really no other way to enable only .zshrc but keep the rest of "disable-common.inc" in place?
@rusty-snake commented on GitHub (Oct 24, 2020):
You can always add a
noblacklist ${HOME}/some/blacklisted/path. I pointed you toignorebecause you would need to addnoblacklist ${HOME}/.config/kritarc,noblacklist ${HOME}/.config/konversationrc,noblacklist ${HOME}/.config/kritarcand so on for all every blacklist. That's more selective, but not usable when allowing maybe paths..zshrc(and.bashrc) are not blacklisted because programs may need to read it (if they start a shell), but they are made read-only. TL;TR: Just addread-write ${HOME}/.zshrc.Maybe you need aldo
ignore read-only ${HOME}/.zshrcbecause the read-only is processed later.@Utini2000 commented on GitHub (Oct 25, 2020):
Thank you so much... that also fixed my .zshrc problem.
The solution seems so simple but I really tried several hours and days to fix it on my own :S
@rusty-snake commented on GitHub (Nov 9, 2020):
I'm closing here due to inactivity, please fell free to request to reopen if you have more questions.