github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #4310] Invalid whitelist path /local #2617

New issue

Closed

opened 2026-05-05 09:16:57 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:16:57 -06:00

Owner

Originally created by @vbooka1 on GitHub (May 27, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4310

Bug and expected behavior

Describe the bug.
What did you expect to happen?

I want to whitelist certain dirs in /local/ because a program needs a write access there.

Reproduce
Steps to reproduce the behavior:

create a profile containing "whitelist /local/path/to/dir"
See error Error: invalid whitelist path /local/path/to/dir

Environment

firejail version 0.9.64.4

Compile time support:
- AppArmor support is enabled
- AppImage support is enabled
- chroot support is enabled
- D-BUS proxy support is enabled
- file and directory whitelisting support is enabled
- file transfer support is enabled
- firetunnel support is enabled
- networking support is enabled
- overlayfs support is disabled
- private-home support is enabled
- private-cache and tmpfs as user enabled
- SELinux support is disabled
- user namespace support is enabled
- X11 sandboxing support is enabled

Additional context
Other context about the problem like related errors to understand the problem.

on my system /local/ is not a separated partition nor a dedicated mount point but just a subdirectory of / (root partition)

Checklist

[v] I have performed a short search for similar issues (to avoid opening a duplicate).

after finding this: #739 I believe it is a limitation within firejail

[v] Used LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM to get english error-messages.
[v] This is not a question. Questions should be asked in https://github.com/netblue30/firejail/discussions.

Originally created by @vbooka1 on GitHub (May 27, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4310 **Bug and expected behavior** - Describe the bug. - What did you expect to happen? I want to whitelist certain dirs in /local/ because a program needs a write access there. **Reproduce** Steps to reproduce the behavior: 1. create a profile containing "whitelist /local/path/to/dir" 2. See error `Error: invalid whitelist path /local/path/to/dir` **Environment** firejail version 0.9.64.4 Compile time support: - AppArmor support is enabled - AppImage support is enabled - chroot support is enabled - D-BUS proxy support is enabled - file and directory whitelisting support is enabled - file transfer support is enabled - firetunnel support is enabled - networking support is enabled - overlayfs support is disabled - private-home support is enabled - private-cache and tmpfs as user enabled - SELinux support is disabled - user namespace support is enabled - X11 sandboxing support is enabled **Additional context** Other context about the problem like related errors to understand the problem. on my system /local/ is not a separated partition nor a dedicated mount point but just a subdirectory of / (root partition) **Checklist** - [v] I have performed a short search for similar issues (to avoid opening a duplicate). after finding this: #739 I believe it is a limitation within firejail - [v] Used `LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM` to get english error-messages. - [v] This is not a question. Questions should be asked in https://github.com/netblue30/firejail/discussions.

gitea-mirror closed this issue

2026-05-05 09:16:58 -06:00

gitea-mirror commented

2026-05-05 09:17:00 -06:00

Author

Owner

@rusty-snake commented on GitHub (May 27, 2021):

Manpage of 0.9.64.4:

--whitelist=dirname_or_filename
Whitelist directory or file. A temporary file system is mounted on the top directory, and the
whitelisted files are mount-binded inside. Modifications to whitelisted files are persistent,
everything else is discarded when the sandbox is closed. The top directory could be
user home, /dev, /etc, /media, /mnt, /opt, /run/user/$UID, /srv, /sys/module, /tmp, /usr/share and /var.

@rusty-snake commented on GitHub (May 27, 2021): Manpage of 0.9.64.4: > **--whitelist=dirname_or_filename** > Whitelist directory or file. A temporary file system is mounted on the top directory, and the > whitelisted files are mount-binded inside. Modifications to whitelisted files are persistent, > everything else is discarded when the sandbox is closed. _The top directory could be_ > _user home, /dev, /etc, /media, /mnt, /opt, /run/user/$UID, /srv, /sys/module, /tmp, /usr/share and /var._

gitea-mirror commented

2026-05-05 09:17:01 -06:00

Author

Owner

@vbooka1 commented on GitHub (May 27, 2021):

I'll try to move the program with all its bindings to /opt/, nevertheless please consider adding /local to the list of allowed top directories.

@vbooka1 commented on GitHub (May 27, 2021): I'll try to move the program with all its bindings to /opt/, nevertheless please consider adding /local to the list of allowed top directories.

gitea-mirror commented

2026-05-05 09:17:02 -06:00

Author

Owner

@rusty-snake commented on GitHub (May 27, 2021):

Nope, /local will not be added ... #4229

@rusty-snake commented on GitHub (May 27, 2021): Nope, /local will not be added ... #4229

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2617

No description provided.

Rows
Columns