github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

firejail #234

New issue

Closed

opened 2026-05-05 05:22:33 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 05:22:33 -06:00

Owner

Originally created by @fdopen on GitHub (Feb 28, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/332

I'm a little bit surprised by the following result (tested under debian):

$ firejail --noprofile --private-etc=hosts --whitelist=/var/tmp find /var /etc
/var
/var/tmp
/etc
/etc/hosts
# ok, like expected!

$ firejail --noprofile --private-etc=hosts --whitelist=/var/tmp find /run/firejail
# What a surprise! I can still access /var
# via /run/firejail/mnt/orig-var
# And there is also a group and passwd file

Why doesn't firejail block access to the files under /run/firejail by default? (A whitelist option for '/run' would be useful, too.)

Originally created by @fdopen on GitHub (Feb 28, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/332 I'm a little bit surprised by the following result (tested under debian): ``` bash $ firejail --noprofile --private-etc=hosts --whitelist=/var/tmp find /var /etc /var /var/tmp /etc /etc/hosts # ok, like expected! $ firejail --noprofile --private-etc=hosts --whitelist=/var/tmp find /run/firejail # What a surprise! I can still access /var # via /run/firejail/mnt/orig-var # And there is also a group and passwd file ``` Why doesn't firejail block access to the files under `/run/firejail` by default? (A whitelist option for '/run' would be useful, too.)

gitea-mirror

2026-05-05 05:22:33 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 05:22:38 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 28, 2016):

Huge problem! I'll have to fix it asap! Thanks for the bug.

$ firejail --whitelist=/var/tmp
Reading profile /etc/firejail/generic.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-terminals.inc

** Note: you can use --noprofile to disable generic.profile **

Parent pid 30774, child pid 30775

Child process initialized
[netblue@debian ~]$ ls /var
tmp
[netblue@debian ~]$ ls /run/firejail/mnt/orig-var/
backups  cache  lib  local  lock  log  mail  opt  run  spool  tmp  www
[netblue@debian ~]$

It probably affects other directories!

@netblue30 commented on GitHub (Feb 28, 2016): Huge problem! I'll have to fix it asap! Thanks for the bug. ``` $ firejail --whitelist=/var/tmp Reading profile /etc/firejail/generic.profile Reading profile /etc/firejail/disable-mgmt.inc Reading profile /etc/firejail/disable-secret.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-terminals.inc ** Note: you can use --noprofile to disable generic.profile ** Parent pid 30774, child pid 30775 Child process initialized [netblue@debian ~]$ ls /var tmp [netblue@debian ~]$ ls /run/firejail/mnt/orig-var/ backups cache lib local lock log mail opt run spool tmp www [netblue@debian ~]$ ``` It probably affects other directories!

gitea-mirror commented

2026-05-05 05:22:41 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Feb 28, 2016):

Until a fix is released, blacklist /run/firejail should do the trick, right?

@chiraag-nataraj commented on GitHub (Feb 28, 2016): Until a fix is released, `blacklist /run/firejail` should do the trick, right?

gitea-mirror commented

2026-05-05 05:22:45 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 28, 2016):

No, it is needed by --join. I'll have a fix today.

@netblue30 commented on GitHub (Feb 28, 2016): No, it is needed by --join. I'll have a fix today.

gitea-mirror commented

2026-05-05 05:22:49 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 28, 2016):

Fixed!

@netblue30 commented on GitHub (Feb 28, 2016): Fixed!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#234

No description provided.

Rows
Columns