[GH-ISSUE #4151] Unset TMP if it doesn't exist inside of sandbox #2553

New issue

Closed

opened 2026-05-05 09:13:40 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 09:13:40 -06:00

Owner

Originally created by @matthew-cline on GitHub (Mar 31, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4151

I have this weird setup where the TMP env var is set to /tmp/$USER and that directory is automatically created. This causes sandboxed apps to not work if the profile uses private-tmp, and the error messages the app generates aren't necessarily useful. I solved the problem by making a wrapper script for firejail which unsets TMP, but other users might have TMP point to a non-standard location and have the sandboxed app not give them and useful error messages, leaving them confused frustrated.

One way to solve the problem would be, if TMP is set, to check if what it points to exists within the sandbox, and unset the var if it doesn't.

Originally created by @matthew-cline on GitHub (Mar 31, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4151 I have this weird setup where the `TMP` env var is set to `/tmp/$USER` and that directory is automatically created. This causes sandboxed apps to not work if the profile uses `private-tmp`, and the error messages the app generates aren't necessarily useful. I solved the problem by making a wrapper script for `firejail` which unsets TMP, but other users might have TMP point to a non-standard location and have the sandboxed app not give them and useful error messages, leaving them confused frustrated. One way to solve the problem would be, if `TMP` is set, to check if what it points to exists within the sandbox, and unset the var if it doesn't.

gitea-mirror

2026-05-05 09:13:40 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 09:13:43 -06:00

Author

Owner

@rusty-snake commented on GitHub (Mar 31, 2021):

where the TMP env var is set to /tmp/$USER

We have already code for TMP=/tmp/user/$UID, maybe this need further adjustments:

0c1b99f4d8/src/firejail/fs_whitelist.c (L780-L796)

I solved the problem by making a wrapper script for firejail which unsets TMP

Just add rmenv TMP to <PROFILE>.local.

@rusty-snake commented on GitHub (Mar 31, 2021): > where the `TMP` env var is set to `/tmp/$USER` We have already code for `TMP=/tmp/user/$UID`, maybe this need further adjustments: https://github.com/netblue30/firejail/blob/0c1b99f4d838811854d1793ac70d5739abed4204/src/firejail/fs_whitelist.c#L780-L796 > I solved the problem by making a wrapper script for firejail which unsets TMP Just add `rmenv TMP` to `<PROFILE>.local`.

gitea-mirror referenced this issue

2026-05-05 10:19:21 -06:00

[PR #2553] [MERGED] Update feh-network.inc #4399

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2553

No description provided.

Rows
Columns