mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3877] Using firejail with private /home with a folder on /home mount point but outside of users folders #2438
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2438
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @esp13 on GitHub (Jan 9, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3877
Hi,
I can start firejail with the private folder inside a chosen folder itself inside my home account :
firejail --noprofile --private=/home/username/thefolderIwantI can start firejail with the private folder inside a chosen folder itself inside an other partition/drive :
firejail --noprofile --private=/mnt/otherpartitionordrive/thefolderIwantBut I don't understand why I can't start firejail with the private folder directly inside a chosen folder on /home with the right permissions :
firejail --noprofile --private=/home/thefolderIwantnotinsideuserhomeI got this error:
I checked the permissions they are the same:
What am I missing?
@smitsohu commented on GitHub (Jan 9, 2021):
I think it should work if you add
--allusersto your options.If it doesn't work, what is your Firejail version?
@esp13 commented on GitHub (Jan 10, 2021):
Thank you much for your fast and correct answer :)
It works with the --allusers option +1:
So I guess Firejail treats the /home mount point differently from other mount points, even though permission on this specific folder is allowed for all users, good to know.
@esp13 commented on GitHub (Jan 10, 2021):
Please tell me if I shouldn't ask more question on this ticket, otherwise I have some:
Inside .sh file:
cd /home/thefolderIwantnotinsideuserhome/FireJail/SteamHome && sleep 1 && firejail --private=/home/thefolderIwantnotinsideuserhome/FireJail/SteamHome --profile=/home/thefolderIwantnotinsideuserhome/FireJail/CustomProfiles/Steam.profile --allusers bash -c "sleep 1@rusty-snake commented on GitHub (Jan 10, 2021):
allusersto a profile? It's the same as using it on the command-line.private home/thefolderIwantnotinsideuserhome/FireJail/SteamHomein/home/thefolderIwantnotinsideuserhome/FireJail/CustomProfiles/Steam.profile, so you just usefirejail --profile=/home/thefolderIwantnotinsideuserhome/FireJail/CustomProfiles/Steam.profile steam.@esp13 commented on GitHub (Jan 16, 2021):
Hi, thank you for your answer,
@rusty-snake commented on GitHub (Jan 16, 2021):
@esp13 commented on GitHub (Jan 16, 2021):
Is there a way to authorise the access to the private folder /home/thefolderIwantnotinsideuserhome/FireJail/SteamHome but not to all the upper folders inside firejail?
Maybe my English is too bad I meant the opposite:
Before launching firejail:
echo $HOMEreturn
/home/myrealusernameAfter launching firejail:
firejail --private=/home/thefolderIwantnotinsideuserhome/FireJail/SteamHome/ --allusersecho $HOMEstill return
/home/myrealusernameI expected 'echo $HOME' to return this inside firejail:
/home/thefolderIwantnotinsideuserhome/FireJail/SteamHome/My firejail version:
@rusty-snake commented on GitHub (Jan 16, 2021):
/is a upper folder and restricting access would make sense). Maybeblacklist /home/foo/baris what you're looking for.privateworks read 1, 2, the manpage or play a bit with it. You could use--env=HOME=/home/foo/barto set$HOMEto your expected value. But this can break programs becausegetpw*will still return/home/user.@esp13 commented on GitHub (Jan 16, 2021):
On my /home mount point:
On the thefolderIwantnotinsideuserhome/FireJail/:
The Steam app shouldn't being able to see anything else than /home/thefolderIwantnotinsideuserhome/FireJail/SteamHome/
So Steam firejailed with
--private=/home/thefolderIwantnotinsideuserhome/FireJail/SteamHome/ --allusersshouldn't have access to :The manpage:
"[...]
$ firejail --private=/home/username/work thunderbird &$ firejail --private=/home/username/work firefox -no-remote &Both Mozilla Thunderbird and Firefox think ~/work is the user home directory [...]"
So shouldn't
echo $HOMEorgetpw*return/home/username/workin this case?On this manpage example, how will firefox and thunderbird think
~/workis the home directory ifecho ~andecho $HOMEreturn/home/username/(it will not return/home/username/work)I certainly missed something, sorry for the troubles :/
@esp13 commented on GitHub (Jan 16, 2021):
mmmm... by testing I think I'm close to understand:
inside firejailed shell with --private=/home/thefolderIwantnotinsideuserhome/FireJail/SteamHome/
when i make :
touch ~/test.txtthe file is created inside /home/thefolderIwantnotinsideuserhome/FireJail/SteamHome/
and not inside /home/user/
When I make
ls ~I see itSo even
$HOMEor~are pointing the real user home directory it goes inside the fake oneIt's Voodoo for me lol
@esp13 commented on GitHub (Jan 16, 2021):
I'm progressing on the problem:
The fake home directory wasn't the cause of my troubles.
I have a permission issue.
Outside FireJail:
ls -laBut inside FireJail for same files, some doesn't have an owner and have different rights:
ls -laThis result in permission rejection.
Maybe it is because I created these files on another computer and moved them after on my new fresh install.
Is there a way to fix this problem properly?
@rusty-snake commented on GitHub (Jan 16, 2021):
blacklist.If these directories belong to an other human user the should be inaccessible for other anyway.
f18124baa4/etc/profile-m-z/steam.profile (L18)f18124baa4/etc/profile-m-z/steam.profile (L22)@esp13 commented on GitHub (Jan 16, 2021):
firejail --private=/home/thefolderIwantnotinsideuserhome/FireJail/SteamHome/ --allusers --blacklist=/home/* --noblacklist=/home/thefolderIwantnotinsideuserhome/FireJail/SteamHome/Or
firejail --private=/home/thefolderIwantnotinsideuserhome/FireJail/SteamHome/ --allusers --noblacklist=/home/thefolderIwantnotinsideuserhome/FireJail/SteamHome/ --blacklist=/home/*Both result in a
Yes I comment this cause I wanted this to stay in the fake home folder.
@rusty-snake commented on GitHub (Jan 16, 2021):
firejail --allusers --noblacklist=/home/user "--blacklist=/home/*" --private=/home/thefolderIwantnotinsideuserhome/FireJail/SteamHome.@esp13 commented on GitHub (Jan 16, 2021):
This worked, but I can't explain myself how, it's magic ^^
--noblacklist=/home/userI fears this will result on letting the app a full access to the real home folder... but no :)"--blacklist=/home/*"what is the aim of the double quote? to execute this after? Can I write--blacklist="/home/*"instead?How should I write this inside the profile file?
But inside FireJail, the permissions are still the same :
ls -laIf I uncomment this lines in the profile file:
The app will still create the files inside the fake home folder?
Why do we need this?
@esp13 commented on GitHub (Jan 16, 2021):
ahhh steam just put a lot of files in my real home directory... I'm sad :(
How does it do this from inside firejail?
-edit2-
Because I wasn't inside FireJail... I was testing to put
--blacklist="/home/*"instead of"--blacklist=/home/*"but this result in error cause I wrote--noblacklist=home/thefolderIwantnotinsideuserhome/FireJail/SteamHomeinstead of--noblacklist=/home/userand I didn't see at first...@rusty-snake commented on GitHub (Jan 16, 2021):
They stop your shell from expanding the
*. If you use special characters like*?!${}you need to tell your shell that it should treat they literally instead of expanding. For some characters like!$you must use single quote.firejail does it, look at the
mkdirandmkfilecommands in the profile. There a very old bug for it: #903.Both should be the same.
@esp13 commented on GitHub (Jan 16, 2021):
You are right, I checked, I updated my texts before.
@esp13 commented on GitHub (Jan 16, 2021):
I goes with
What do you think?
It seems to be still necessary to unquote this with the previous profile, but why? Isn't the
noblacklist ~supposed to make the stuff?@rusty-snake commented on GitHub (Jan 16, 2021):
Sorry I don't get your last question.
@esp13 commented on GitHub (Jan 16, 2021):
Why in the standard steam profile file, do we need to do the noblacklist for folders already inside the fake home folder?
@esp13 commented on GitHub (Jan 16, 2021):
I wanted to check graphically what the FireJailed app will be able to see on the disk so I went with
firejail --profile=/home/FireJail_customsteam.profile bash -c "nemo"but I get a normal user access, did I missed something?Maybe should I use
firejail --profile=/home/FireJail_customsteam.profile bash -c "nemo-desktop"instead? But this crashed@rusty-snake commented on GitHub (Jan 16, 2021):
nemo likely runs already (in the background) and nemo (inside the sandbox) talks to nemo (outside) which then opens a new window.
Options:
--dbus-user=none.Aside: the
bash -cis overkill, justnemoworks too.@rusty-snake commented on GitHub (Jan 16, 2021):
On
(no)blacklistand(no)whitelistthe${HOME}macro expands to the private/fake home if it's that what you hang on. (It's complicated I know)@esp13 commented on GitHub (Jan 16, 2021):
Thank you it works with
--nodbusoptionSo results:
@rusty-snake commented on GitHub (Jan 16, 2021):
add
disable-mntThe problem with steam.profile is that it is a profile which should work with many different programs/games resulting in a relative weak profile to not break ugly written games.
@esp13 commented on GitHub (Jan 16, 2021):
As I use a fake home folder why does have I to specify each of this folders individually?
with those lines commented I get:
with those lines active I get
I don't understand why
I can create and modify a lot of files/folders in this fake home folder as I want.
Why for this specifics ones I need to noblacklist it?
@esp13 commented on GitHub (Jan 16, 2021):
This worked great thank you :)
@esp13 commented on GitHub (Jan 17, 2021):
It is really hard to understand.
I started a fresh new installation with all this noblacklist commented in firejail steam profile,
the files created have this permissions:
I just close the sandbox and re-open it the same way, I got this:
Anyway, I have an other problem : a segmentation fault (core dumped) but seems to happen to a lot of people even outside of firejail.
@rusty-snake commented on GitHub (Jan 17, 2021):
Because these special ones have a
blacklistcommand in disable-programs.incThe
blacklistonly takes effect if the files are present when the sandbox is started.@esp13 commented on GitHub (Jan 17, 2021):
Oh this is easier to understand, thank you!
As I run steam on a fake home and this file is containing at 99% home folders, I could safely comment this
include disable-programs.incline right?@rusty-snake commented on GitHub (Jan 17, 2021):
and the remaining 1% are covered by
private-tmpandinclude whitelist-var-common.inc.Yes, but why? Just keep the
noblacklist.@esp13 commented on GitHub (Jan 17, 2021):
Yes but as I use a fake home folder I find weird to remove a lot of permissions with
include disable-programs.incto put some back whit thisnoblacklistIf I upgrade firejail, and some new steam folders permissions are removed with
disable-programs.incas I will keep my custom profile this will result on blocking this new folders.And maybe I will earn some execution time by avoiding removing a lot of permissions and putting some back after. Perhaps... 0.00001s earned :-D
@esp13 commented on GitHub (Jan 17, 2021):
I'm progressing, now I get
Gtk-Message: Failed to load module "xapp-gtk3-module"I think this comes from my distro as I get this for other app outside firejailGtk-Message: Failed to load module "gail"Gtk-Message: Failed to load module "atk-bridge"Could not connect to X session manager: None of the authentication protocols specified are supported@esp13 commented on GitHub (Jan 17, 2021):
It was seccomp fault. Once I commented it, no more crashing error.
Maybe it's cause I have an AMD GPU? https://github.com/netblue30/firejail/issues/3219
@rusty-snake commented on GitHub (Jan 17, 2021):
Try
seccomp !kcmp.@esp13 commented on GitHub (Jan 17, 2021):
This worked, thank you :)
-Edit-
No I must have made a mistake (not saved I think)
With
seccomp !kcmpit doesn't work neitherSo now here his my profile file:
@esp13 commented on GitHub (Jan 17, 2021):
I will make a custom profile for the French application molotov.tv
As it doesn't exist in etc/firejail,
do you have an idea of a similar application were the firejail profile exist I could start with?
Molotov.tv is an application to watch tv on computer through internet (it use DRM)
It is distributed as an .Appimage file.
@rusty-snake commented on GitHub (Jan 17, 2021):
/usr/share/doc/firejail/profile.template
@esp13 commented on GitHub (Jan 22, 2021):
Thank you, yes this is the default profile. I guess there are no already custom profile for appimage files?
As this is going far away from original issue, I opened a new one here.
Please tell me if I shouldn't
PS : for information this link from basic-usage tutorial is going nowhere
@rusty-snake commented on GitHub (Jan 22, 2021):
@netblue30 https://firejail.wordpress.com/documentation-2/basic-usage/#profiles:
-- https://firejail.wordpress.com/documentation-2/building-whitelisted-profiles/ --
++ https://firejail.wordpress.com/documentation-2/building-custom-profiles/#whitelisted ++
@esp13 commented on GitHub (Feb 14, 2021):
Hello,
Is it possible to use 'disable-mnt' but to allow at the same time some exceptions for some folders?
I tried this without succes:
Neither with this:
Neither this from https://github.com/netblue30/firejail/issues/3581 :
@esp13 commented on GitHub (Feb 14, 2021):
I finally get it by many tries :
But I would like to understand why this worked
@rusty-snake commented on GitHub (Feb 15, 2021):
No, but there are other ways to have the same effect: #3580, #3581, https://github.com/netblue30/firejail/issues/3912#issuecomment-770192450, ...
whitelistadds restriction rather removing any of them. You can onlywhitelistfiles which you can access when running with--ignore=whitelist.Since these paths are never
blacklisted, anoblacklisthas no effect.https://github.com/netblue30/firejail/issues/3581#issuecomment-672018630 and the following
🎉
You should add
blacklist /run/mntandblacklist /run/mediaand changeblacklist /mnt/*toblacklist /mntfor better security.Because you commented/
ignoreeddisable-mnt. Therefore you can start adding more selective commands.@esp13 commented on GitHub (Feb 15, 2021):
Hello,
Thank you again for your detailed answers.
Yes of course I forget that a whitelist refuse all except what is expressively allowed!
In firejail this works by mount points right? ~, /dev, /media, /mnt, /opt, /srv, /var, and /tmp
So it is why I didn't had to blacklist /media in my usage cause I used whitelist inside this folder right?
so I will go with:
Is it possible to keep
blacklist /mediasomewhere so if the lineswhitelist /media/user/usbkey1andwhitelist /media/user/disk1/folder1are removed, the sandbox will refuse access to /media ?@rusty-snake commented on GitHub (Feb 15, 2021):
Together with
noblacklist /media:@esp13 commented on GitHub (Feb 16, 2021):
It doesn't seem to work, in this case the app get full /media access:
@rusty-snake commented on GitHub (Feb 16, 2021):
Why did you comment the
whitelist?@esp13 commented on GitHub (Feb 16, 2021):
This was the aim.
My question was to find a way to blacklist /media if the whitelist are removed from the profile.
While copying to a new profile file for an other app, I fear to remove the whitelist lines (cause not needed anymore) but to forget to add the blacklist /media line.
@esp13 commented on GitHub (Feb 16, 2021):
But maybe i could just add a comment on my whitelist lines:
@rusty-snake commented on GitHub (Feb 16, 2021):
You can add
blacklist /media, but only if you addnoblacklist /mediatoo. As long as you keep thewhitelistand thenoblacklisttogether (maybe even mixed; whitelist noblacklist whitelist), you likely remove the noblacklist together with the whitelist and end withblacklist /media.@esp13 commented on GitHub (Feb 17, 2021):
Is there a way to put
whitelist /media/user/disk1/folder1andnoblacklist /mediaon the same line?Is
whitelist /media/user/disk1/folder1putting the folder in read-only for the sandbox or does it comes from elsewhere?Edit: I get it:
I had to run
sudo usermod -a -G vboxsf userinside the virtualbox@rusty-snake commented on GitHub (Feb 18, 2021):
No, one command per line.
Some where else.