github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #4742] Bind instead of copy for private-{bin,etc,lib,opt,srv} #2771

New issue

Open

opened 2026-05-05 09:26:07 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:26:07 -06:00

Owner

Originally created by @Thaodan on GitHub (Dec 5, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4742

If a profile uses private-etc/private-bin the entries mentioned are copied to the sandboxes directory which increases space and makes outside changes not visible to the processes running inside the sandbox.

Describe the solution you'd like

If private-etc instead would bind mount the directories to the sandbox outside changes to the process running in the sandbox visible.

Describe alternatives you've considered

Whitelist paths in /etc however I'm not sure if this would work for the those use-cases.

Originally created by @Thaodan on GitHub (Dec 5, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4742 ### Is your feature request related to a problem? If a profile uses private-etc/private-bin the entries mentioned are copied to the sandboxes directory which increases space and makes outside changes not visible to the processes running inside the sandbox. ### Describe the solution you'd like If private-etc instead would bind mount the directories to the sandbox outside changes to the process running in the sandbox visible. ### Describe alternatives you've considered Whitelist paths in /etc however I'm not sure if this would work for the those use-cases.

gitea-mirror added the

enhancement

bug

labels 2026-05-05 09:26:07 -06:00

gitea-mirror commented

2026-05-05 09:26:09 -06:00

Author

Owner

@rusty-snake commented on GitHub (Dec 5, 2021):

If private-etc instead would bind mount the directories to the sandbox outside changes to the process running in the sandbox visible.

FTR: Changes are only visible if they are performed with a write like semantic. If the changes are performed with a open+write+close+rename like semantic, they will not show up.

@rusty-snake commented on GitHub (Dec 5, 2021): > If private-etc instead would bind mount the directories to the sandbox outside changes to the process running in the sandbox visible. FTR: Changes are only visible if they are performed with a `write` like semantic. If the changes are performed with a `open`+`write`+`close`+`rename` like semantic, they will not show up.

gitea-mirror commented

2026-05-05 09:26:10 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 8, 2022):

IMHO we should bind instead of copy for all private-* except private-home (private-{bin,etc,lib,opt,srv}) because it causes slowdowns (#5162) and can have an incredible high memory foodprint (#5178).

@rusty-snake commented on GitHub (Jun 8, 2022): IMHO we should bind instead of copy for all `private-*` except `private-home` (`private-{bin,etc,lib,opt,srv}`) because it causes slowdowns (#5162) and can have an incredible high memory foodprint (#5178).

gitea-mirror commented

2026-05-05 09:26:11 -06:00

Author

Owner

@otonoton commented on GitHub (Jul 30, 2024):

Has there been any work on this?

@otonoton commented on GitHub (Jul 30, 2024): Has there been any work on this?

gitea-mirror referenced this issue

2026-05-05 10:21:38 -06:00

[PR #2771] [MERGED] mount new proc filesystem earlier #4520

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2771

No description provided.

Rows
Columns