github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3731] Is it possible through firejail to make available what the launched user is not available? #2355

New issue

Closed

opened 2026-05-05 09:02:20 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:02:20 -06:00

Owner

Originally created by @13ilya-old on GitHub (Nov 7, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3731

Is it possible through firejail to make available what the launched user is not available?

The idea is to protect the profile with all firefox passwords "~ / .mozilla" from itself and any scripts and programs running from my user, but if I run firefox through firejail (suid is available) then firefox could access my profile which I do not have.

Originally created by @13ilya-old on GitHub (Nov 7, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3731 Is it possible through firejail to make available what the launched user is not available? The idea is to protect the profile with all firefox passwords "~ / .mozilla" from itself and any scripts and programs running from my user, but if I run firefox through firejail (suid is available) then firefox could access my profile which I do not have.

gitea-mirror closed this issue

2026-05-05 09:02:22 -06:00

gitea-mirror commented

2026-05-05 09:02:25 -06:00

Author

Owner

@13ilya-old commented on GitHub (Nov 7, 2020):

A script immediately comes to mind that then the script can create a config and access any file on the computer.
But you can restrict such an option or so that it is only in /etc, or the configuration file containing such an option must be owned by root with privileges no higher than 0644, otherwise it is ignored or the config is completely rejected.

@13ilya-old commented on GitHub (Nov 7, 2020): A script immediately comes to mind that then the script can create a config and access any file on the computer. But you can restrict such an option or so that it is only in /etc, or the configuration file containing such an option must be owned by root with privileges no higher than 0644, otherwise it is ignored or the config is completely rejected.

gitea-mirror commented

2026-05-05 09:02:25 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 7, 2020):

You could use firejail as login-shell and add such blacklist. You would then need a program outside this user-sandbox to start firefox. However, wayland does not use a shell and systemd/logind too IIRC.

I think SELinux would be good for that.

@rusty-snake commented on GitHub (Nov 7, 2020): You could use firejail as login-shell and add such blacklist. You would then need a program outside this user-sandbox to start firefox. However, wayland does not use a shell and systemd/logind too IIRC. I think SELinux would be good for that.

gitea-mirror commented

2026-05-05 09:02:26 -06:00

Author

Owner

@13ilya-old commented on GitHub (Nov 7, 2020):

Thank you, I see.

@13ilya-old commented on GitHub (Nov 7, 2020): Thank you, I see.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2355

No description provided.

Rows
Columns