github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #4607] `noprinters` #2719

New issue

Closed

opened 2026-05-05 09:23:08 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 09:23:08 -06:00

Owner

Originally created by @rusty-snake on GitHub (Oct 15, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4607

Describe the solution you'd like

noprinters command to disable printing. It should blacklist /dev/lp* stuff and /run/cups/cups.sock.

This idea is based on the observation that wrc has

/run/**/resolv.conf which is either needed or useless because of net none
/run/dbus/system_bus_socket which is further handled by dbus-system
/run/media which is further handled by disable-mnt/disable-write-mnt.inc
/run/cups/cups.sock which is not handled elsewhere.

Originally created by @rusty-snake on GitHub (Oct 15, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4607 ### Describe the solution you'd like `noprinters` command to disable printing. It should `blacklist /dev/lp*` stuff and `/run/cups/cups.sock`. This idea is based on the observation that wrc has - `/run/**/resolv.conf` which is either needed or useless because of `net none` - `/run/dbus/system_bus_socket` which is further handled by `dbus-system` - `/run/media` which is further handled by `disable-mnt`/`disable-write-mnt.inc` - `/run/cups/cups.sock` which is not handled elsewhere.

gitea-mirror

2026-05-05 09:23:08 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 09:23:11 -06:00

Author

Owner

@netblue30 commented on GitHub (Oct 21, 2021):

Done! --noprinters on command line, noprinters in profile. You guys do some testing, I don't have a printer here and /dev/lp* doesn't appear under my /dev. I'll add the man pages later.

@netblue30 commented on GitHub (Oct 21, 2021): Done! --noprinters on command line, noprinters in profile. You guys do some testing, I don't have a printer here and /dev/lp* doesn't appear under my /dev. I'll add the man pages later.

gitea-mirror commented

2026-05-05 09:23:12 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 21, 2021):

FTR: bd15e763ea + d9403dcdc8

edit: remember relnotes

@rusty-snake commented on GitHub (Oct 21, 2021): FTR: bd15e763eab8c07072f8ef495a17d387c26150c7 + d9403dcdc8cfb23d5350b0488817a5eaa5a0f20d edit: remember relnotes

gitea-mirror commented

2026-05-05 09:23:13 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 21, 2021):

I've /dev/lp{1..4} (even if I have no physical connected printers, only IPP).
blacklist /dev/lp* works
--noprofile --noprinters --net=none blocks CUPS (e.g. the print dialog from evince only lists "print to pdf")

--net=none is required because

Listen localhost:631
Listen /run/cups/cups.sock

@rusty-snake commented on GitHub (Oct 21, 2021): - I've `/dev/lp{1..4}` (even if I have no physical connected printers, only IPP). - `blacklist /dev/lp*` works - `--noprofile --noprinters --net=none` blocks CUPS (e.g. the print dialog from evince only lists "print to pdf") - `--net=none` is required because ``` Listen localhost:631 Listen /run/cups/cups.sock ```

gitea-mirror commented

2026-05-05 09:23:14 -06:00

Author

Owner

@WhyNotHugo commented on GitHub (Dec 3, 2021):

How about disabling printers by default and having a printers command to enable them when desired?

It's a bit easier to think about permissions in terms of "profile doesn't allow anything, unless otherwise stated", rather than the other way around.

@WhyNotHugo commented on GitHub (Dec 3, 2021): How about disabling printers by default and having a `printers` command to enable them when desired? It's a bit easier to think about permissions in terms of "profile doesn't allow anything, unless otherwise stated", rather than the other way around.

gitea-mirror commented

2026-05-05 09:23:15 -06:00

Author

Owner

@rusty-snake commented on GitHub (Dec 3, 2021):

While I generally agree with you to list everything that is required rather than listing everything which is not required (enumerating badness vs. goodness), I don't feel good about changing the logic how firejail works.

@rusty-snake commented on GitHub (Dec 3, 2021): While I generally agree with you to list everything that is required rather than listing everything which is not required (enumerating badness vs. goodness), I don't feel good about changing the logic how firejail works.

gitea-mirror referenced this issue

2026-05-05 10:21:15 -06:00

[PR #2719] [MERGED] Harden gnome-chess #4497

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2719

No description provided.

Rows
Columns

[GH-ISSUE #4607] noprinters #2719

Describe the solution you'd like

[GH-ISSUE #4607] `noprinters` #2719