map_files: Permission denied #2729

New issue

Open

opened 2026-05-05 09:23:33 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 09:23:33 -06:00

Owner

Originally created by @muziker on GitHub (Oct 19, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4623

Description

It's less of a bug, more of wondering why firejail does this with firefox

Steps to Reproduce

start firejail firefox as user
ls /proc/pid of all instances of firefox
cd /proc/pid of a firefox instance as user
ls -l map_files : permission denied

Expected behavior

The directory is listed as user:user as the owner and group owner. An ls should show all mapped files

Actual behavior

It does not allow the user which started firejail firefox to list all the mapped files

Behavior without a profile

Starting firefox manually allows listing of the mapped files

Additional context

When using firejail to start firefox, to check outgoing socket connects, an lsof -i is used to show active connects. However lsof -i does not work when used together with firejail. Looking into /proc shows namespace isolation stops proper output of lsof -i, and related directories like the map_files are not readable by the user.

Environment

Ubuntu 20.04 , firefox 93.0 from repo, firejail 0.9.62 from repo.

Originally created by @muziker on GitHub (Oct 19, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4623 ### Description It's less of a bug, more of wondering why firejail does this with firefox ### Steps to Reproduce 1. start firejail firefox as user 2. `ls /proc/pid` of all instances of firefox 3. `cd /proc/pid` of a firefox instance as user 4. ls -l map_files : permission denied ### Expected behavior The directory is listed as user:user as the owner and group owner. An ls should show all mapped files ### Actual behavior It does not allow the user which started firejail firefox to list all the mapped files ### Behavior without a profile Starting firefox manually allows listing of the mapped files ### Additional context When using firejail to start firefox, to check outgoing socket connects, an lsof -i is used to show active connects. However lsof -i does not work when used together with firejail. Looking into /proc shows namespace isolation stops proper output of lsof -i, and related directories like the map_files are not readable by the user. ### Environment Ubuntu 20.04 , firefox 93.0 from repo, firejail 0.9.62 from repo.

gitea-mirror added the

question

label 2026-05-05 09:23:33 -06:00

gitea-mirror commented

2026-05-05 09:23:35 -06:00

Author

Owner

@rusty-snake commented on GitHub (Mar 21, 2022):

ping, there's a discussion in #5035.

@rusty-snake commented on GitHub (Mar 21, 2022): ping, there's a discussion in #5035.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2729

No description provided.

Rows
Columns