github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #338] Permission denied vs. Not found #240

New issue

Closed

opened 2026-05-05 05:23:58 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 05:23:58 -06:00

Owner

Originally created by @chiraag-nataraj on GitHub (Feb 29, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/338

This isn't really an issue, it's just more of a question.
I use private-bin in both firefox and libreoffice, and in both cases, the filter is extremely limited. When I join the libreoffice jail, I get a <such and such>: not found. If, however, I join the firefox jail, I get a <such and such>: Permission denied. Why is there this difference?

For reference, here is my firefox profile:

# Blacklist/Whitelist

blacklist /usr/local/bin
blacklist /usr/local/sbin

whitelist ${HOME}/.mozilla
whitelist ${HOME}/Downloads/
whitelist ${HOME}/.pulse/
whitelist ${HOME}/.config/pulse/
whitelist ${HOME}/.config/gtk-3.0/
whitelist ${HOME}/.config/google-googletalkplugin/
whitelist ${HOME}/.gtkrc-2.0
whitelist ${HOME}/.gtkrc.mine
whitelist ${HOME}/.Xauthority
whitelist ${HOME}/PDF/

# Private directories

private-bin firefox.real,firefox,which,sh
private-etc hosts,passwd,mime.types,fonts/,mailcap,iceweasel/,xdg/,gtk-3.0/,resolv.conf,X11/,pulse/,adobe/,gcrypt/,alternatives/
private-tmp

# Miscellaneous options

shell none
seccomp
noroot
caps.drop all
protocol unix,inet,inet6

And here is my libreoffice profile:

whitelist ${HOME}/Documents
whitelist ${HOME}/.config/libreoffice
whitelist ${HOME}/.config/gtk-3.0
whitelist ${HOME}/.gtkrc-2.0
whitelist ${HOME}/.gtkrc.mine
private-dev
private-bin sh,libreoffice,dirname,grep,uname,ls,sed,pwd,basename
private-etc libreoffice,fonts,passwd
caps.drop all
noroot
nogroups
shell none
net none
seccomp

Originally created by @chiraag-nataraj on GitHub (Feb 29, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/338 This isn't really an issue, it's just more of a question. I use private-bin in both firefox and libreoffice, and in both cases, the filter is _extremely_ limited. When I join the libreoffice jail, I get a `<such and such>: not found`. If, however, I join the firefox jail, I get a `<such and such>: Permission denied`. Why is there this difference? For reference, here is my firefox profile: ``` # Blacklist/Whitelist blacklist /usr/local/bin blacklist /usr/local/sbin whitelist ${HOME}/.mozilla whitelist ${HOME}/Downloads/ whitelist ${HOME}/.pulse/ whitelist ${HOME}/.config/pulse/ whitelist ${HOME}/.config/gtk-3.0/ whitelist ${HOME}/.config/google-googletalkplugin/ whitelist ${HOME}/.gtkrc-2.0 whitelist ${HOME}/.gtkrc.mine whitelist ${HOME}/.Xauthority whitelist ${HOME}/PDF/ # Private directories private-bin firefox.real,firefox,which,sh private-etc hosts,passwd,mime.types,fonts/,mailcap,iceweasel/,xdg/,gtk-3.0/,resolv.conf,X11/,pulse/,adobe/,gcrypt/,alternatives/ private-tmp # Miscellaneous options shell none seccomp noroot caps.drop all protocol unix,inet,inet6 ``` And here is my libreoffice profile: ``` whitelist ${HOME}/Documents whitelist ${HOME}/.config/libreoffice whitelist ${HOME}/.config/gtk-3.0 whitelist ${HOME}/.gtkrc-2.0 whitelist ${HOME}/.gtkrc.mine private-dev private-bin sh,libreoffice,dirname,grep,uname,ls,sed,pwd,basename private-etc libreoffice,fonts,passwd caps.drop all noroot nogroups shell none net none seccomp ```

gitea-mirror

2026-05-05 05:23:58 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:24:03 -06:00

Author

Owner

@netblue30 commented on GitHub (Mar 2, 2016):

Give me some examples (command and output). There could be something there, I'll take a look. Thanks.

@netblue30 commented on GitHub (Mar 2, 2016): Give me some examples (command and output). There could be something there, I'll take a look. Thanks.

gitea-mirror commented

2026-05-05 05:24:06 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Mar 2, 2016):

Using the profiles in the OP,

firejail --join=`pidof iceweasel`
$ cat
/bin/sh: 1: cat: Permission denied

versus

firejail --join=`pidof soffice.bin`
$ cat
/bin/sh: 1: cat: not found

@chiraag-nataraj commented on GitHub (Mar 2, 2016): Using the profiles in the OP, ``` firejail --join=`pidof iceweasel` $ cat /bin/sh: 1: cat: Permission denied ``` versus ``` firejail --join=`pidof soffice.bin` $ cat /bin/sh: 1: cat: not found ```

gitea-mirror commented

2026-05-05 05:24:08 -06:00

Author

Owner

@netblue30 commented on GitHub (Mar 4, 2016):

It doesn't find /bin/cat, you need to add it to private-bin.

In your profiles, disable private-bin (comment it out with a #). Run "sudo firemon" in a different terminal. This will give you a list of all the programs the sandbox tries to run when you start the sandboxes. Then, you add all these programs to private-bin and enable it.

@netblue30 commented on GitHub (Mar 4, 2016): It doesn't find /bin/cat, you need to add it to private-bin. In your profiles, disable private-bin (comment it out with a #). Run "sudo firemon" in a different terminal. This will give you a list of all the programs the sandbox tries to run when you start the sandboxes. Then, you add all these programs to private-bin and enable it.

gitea-mirror commented

2026-05-05 05:24:10 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Mar 4, 2016):

I know it doesn't find /bin/cat (I didn't want it to). My point is that cat is blacklisted in both of the profiles, but each gives a different error message.

@chiraag-nataraj commented on GitHub (Mar 4, 2016): I know it doesn't find /bin/cat (I didn't want it to). My point is that cat is blacklisted in both of the profiles, but each gives a different error message.

gitea-mirror commented

2026-05-05 05:24:12 -06:00

Author

Owner

@netblue30 commented on GitHub (Mar 5, 2016):

I guess they are used interchangeably in the code, or even in some system utilities firejail calls during sandbox init.

@netblue30 commented on GitHub (Mar 5, 2016): I guess they are used interchangeably in the code, or even in some system utilities firejail calls during sandbox init.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#240

No description provided.

Rows
Columns