user-dirs.dirs if they are not in "$HOME". #2357

New issue

Open

opened 2026-05-05 09:02:29 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 09:02:29 -06:00

Owner

Originally created by @13ilya-old on GitHub (Nov 10, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3735

When I specify "blacklist ${DOCUMENTS}" in the config, I expect that the path to the documents directory assigned in my KDE will be blocked. But this only works if the path starts with $HOME. If this is not the case, for example (/Data/Documents) then "$HOME/Documents" is used instead.

cat ~/.config/user-dirs.dirs
XDG_DESKTOP_DIR="$HOME/Desktop/"
XDG_DOCUMENTS_DIR="/Data/Documents"
XDG_DOWNLOAD_DIR="$HOME/Downloads/"
XDG_MUSIC_DIR="/Data/Music"
XDG_PICTURES_DIR="/Data/Pictures"
XDG_PUBLICSHARE_DIR="$HOME/"
XDG_TEMPLATES_DIR="$HOME/"
XDG_VIDEOS_DIR="/Data/Video"

openSUSE Tumbleweed
KDE
firejail 0.9.64

Originally created by @13ilya-old on GitHub (Nov 10, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3735 When I specify "blacklist ${DOCUMENTS}" in the config, I expect that the path to the documents directory assigned in my KDE will be blocked. But this only works if the path starts with $HOME. If this is not the case, for example (/Data/Documents) then "$HOME/Documents" is used instead. cat ~/.config/user-dirs.dirs XDG_DESKTOP_DIR="$HOME/Desktop/" XDG_DOCUMENTS_DIR="/Data/Documents" XDG_DOWNLOAD_DIR="$HOME/Downloads/" XDG_MUSIC_DIR="/Data/Music" XDG_PICTURES_DIR="/Data/Pictures" XDG_PUBLICSHARE_DIR="$HOME/" XDG_TEMPLATES_DIR="$HOME/" XDG_VIDEOS_DIR="/Data/Video" openSUSE Tumbleweed KDE firejail 0.9.64

gitea-mirror added the

bug

label 2026-05-05 09:02:29 -06:00

gitea-mirror commented

2026-05-05 09:02:31 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 10, 2020):

But in reality it is just hardcoded to "${HOME}/Documents" ignoring the KDE settings in the file "~/.config/user-dirs.dirs".

It's not hardcoded, user-dirs.dirs is parsed.

$ firejail --noprofile '--blacklist=${DOCUMENTS}' ls Dokumente
ls: cannot open directory 'Dokumente': Permission denied
# Edit ~/.config/user-dirs.dirs: XDG_DOCUMENTS_DIR="$HOME/DokumentenEnte"
firejail --noprofile '--blacklist=${DOCUMENTS}' ls Dokumente DokumentenEnte
Dokumente:
 foo     bar
ls: cannot open directory 'DokumentenEnte': Permission denied

However, user-dirs.dirs is not parse correctly. The code expects that the line for ${DOCUMENTS} starts with XDG_DOCUMENTS_DIR=\"$HOME/ and the part after the / is then used relative to cfg.homedir.

@rusty-snake commented on GitHub (Nov 10, 2020): > But in reality it is just hardcoded to "${HOME}/Documents" ignoring the KDE settings in the file "~/.config/user-dirs.dirs". It's not hardcoded, user-dirs.dirs is parsed. ``` $ firejail --noprofile '--blacklist=${DOCUMENTS}' ls Dokumente ls: cannot open directory 'Dokumente': Permission denied # Edit ~/.config/user-dirs.dirs: XDG_DOCUMENTS_DIR="$HOME/DokumentenEnte" firejail --noprofile '--blacklist=${DOCUMENTS}' ls Dokumente DokumentenEnte Dokumente: foo bar ls: cannot open directory 'DokumentenEnte': Permission denied ``` However, user-dirs.dirs is not parse correctly. The code expects that the line for `${DOCUMENTS}` starts with `XDG_DOCUMENTS_DIR=\"$HOME/` and the part after the `/` is then used relative to `cfg.homedir`.

gitea-mirror commented

2026-05-05 09:02:32 -06:00

Author

Owner

@13ilya-old commented on GitHub (Nov 10, 2020):

Your script also works for me.
But I'm not specifying the path in $HOME, but on another partition of the disk /Data.
And this is no longer processed, and instead of "/Data/Documents", "$HOME/Documents" is blocked.

@13ilya-old commented on GitHub (Nov 10, 2020): Your script also works for me. But I'm not specifying the path in $HOME, but on another partition of the disk /Data. And this is no longer processed, and instead of "/Data/Documents", "$HOME/Documents" is blocked.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2357

No description provided.

Rows
Columns