github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #4460] --build clears the environment #2676

New issue

Closed

opened 2026-05-05 09:20:12 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:20:12 -06:00

Owner

Originally created by @rusty-snake on GitHub (Aug 9, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4460

Bug and expected behavior

Describe the bug.

--build clears the env. Only a few firejail set variables and LANG, PATH, DISPLAY and SHELL are kept.

$ firejail --build printenv
LANG=de_DE.UTF-8
PATH=/home/rusty-snake/.config/firecfg.py/overrides/bin:/etc/firecfg.py/overrides/bin:/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/home/rusty-snake/.local/bin:/home/rusty-snake/.cargo/bin
DISPLAY=:0
QT_X11_NO_MITSHM=1
QML_DISABLE_DISK_CACHE=1
container=firejail
SHELL=/bin/bash
KDE_FORK_SLAVES=1
PROMPT_COMMAND=:
FIREJAIL_QUIET=yes

This makes --build unusable for programs which assume variables like HOME are set (os.environ["HOME"]).

What did you expect to happen?

Variables like HOME are still present.

Reproduce
Steps to reproduce the behavior:

Run in bash firejail --build printenv
See error nearly empty environment

Environment

Linux distribution and version: Fedora 34
Firejail version: 0.9.66+3836131f-dirty

Checklist

The profile (and redirect profile if exists) hasn't already been fixed upstream.
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
I have performed a short search for similar issues (to avoid opening a duplicate).
If it is a AppImage, --profile=PROFILENAME is used to set the right profile.
Used LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM to get english error-messages.
I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
This is not a question. Questions should be asked in https://github.com/netblue30/firejail/discussions.

Originally created by @rusty-snake on GitHub (Aug 9, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4460 **Bug and expected behavior** - Describe the bug. `--build` clears the env. Only a few firejail set variables and LANG, PATH, DISPLAY and SHELL are kept. ``` $ firejail --build printenv LANG=de_DE.UTF-8 PATH=/home/rusty-snake/.config/firecfg.py/overrides/bin:/etc/firecfg.py/overrides/bin:/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/home/rusty-snake/.local/bin:/home/rusty-snake/.cargo/bin DISPLAY=:0 QT_X11_NO_MITSHM=1 QML_DISABLE_DISK_CACHE=1 container=firejail SHELL=/bin/bash KDE_FORK_SLAVES=1 PROMPT_COMMAND=: FIREJAIL_QUIET=yes ``` This makes `--build` unusable for programs which assume variables like HOME are set (`os.environ["HOME"]`). - What did you expect to happen? Variables like HOME are still present. **Reproduce** Steps to reproduce the behavior: 1. Run in bash `firejail --build printenv` 2. See error nearly empty environment **Environment** - Linux distribution and version: Fedora 34 - Firejail version: 0.9.66+3836131f-dirty **Checklist** - [ ] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [ ] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [ ] I have performed a short search for similar issues (to avoid opening a duplicate). - [ ] If it is a AppImage, `--profile=PROFILENAME` is used to set the right profile. - [ ] Used `LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM` to get english error-messages. - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] This is not a question. Questions should be asked in https://github.com/netblue30/firejail/discussions.

gitea-mirror

2026-05-05 09:20:12 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 09:20:15 -06:00

Author

Owner

@jmetrius commented on GitHub (Aug 11, 2021):

firejail applies a filtered set of environment variables before handing off to fbuilder which takes care of the actual profile building. fbuilder itself does nothing to restore the original environment before starting the sandbox via firejail

04fba33a07/src/firejail/main.c (L925-L947)

Using env_apply_all() at line 940 gives the expected behaviour for firejail --build printenv.

However I don't understand what the intention for handing over a sanitized environment for fbuilder actually is. If restoring the original environment from fbuilder should be more desirable, the solution doesn't seem that trivial.

@jmetrius commented on GitHub (Aug 11, 2021): firejail applies a filtered set of environment variables before handing off to fbuilder which takes care of the actual profile building. fbuilder itself does nothing to restore the original environment before starting the sandbox via firejail https://github.com/netblue30/firejail/blob/04fba33a071bf80a47963ca9901e1621dc6ace10/src/firejail/main.c#L925-L947 Using `env_apply_all()` at line 940 gives the expected behaviour for `firejail --build printenv`. However I don't understand what the intention for handing over a sanitized environment for fbuilder actually is. If restoring the original environment from fbuilder should be more desirable, the solution doesn't seem that trivial.

gitea-mirror commented

2026-05-05 09:20:15 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 11, 2021):

Maybe it is just a code-path forgotten in #3322. @topimiettinen?

@rusty-snake commented on GitHub (Aug 11, 2021): Maybe it is just a code-path forgotten in #3322. @topimiettinen?

gitea-mirror commented

2026-05-05 09:20:17 -06:00

Author

Owner

@topimiettinen commented on GitHub (Aug 12, 2021):

I haven't used --build, but if fbuilder needs all environment variables, the fix should be simply to change env_apply_whitelist_sbox() to env_apply_all().

@topimiettinen commented on GitHub (Aug 12, 2021): I haven't used `--build`, but if `fbuilder` needs all environment variables, the fix should be simply to change `env_apply_whitelist_sbox()` to `env_apply_all()`.

gitea-mirror referenced this issue

2026-05-05 10:20:52 -06:00

[PR #2676] [MERGED] Refactor min as chromium redirect profile #4477

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2676

No description provided.

Rows
Columns