github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #4780] private-cwd leaks access to the entire filesystem #2778

New issue

Closed

opened 2026-05-05 09:26:19 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 09:26:19 -06:00

Owner

Originally created by @WhyNotHugo on GitHub (Dec 16, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4780

Description

Using firejail --private --private-cwd=. /usr/bin/sh leaks access to the entire filesystem.

Steps to Reproduce

cd into some subdirectory of $HOME.
`firejail --private --private-cwd=. /usr/bin/sh
ls ../../some-file (for a relative path that exists). cat also works.

Expected behavior

Access to these files should not be possible.

Actual behavior

Access to files using relative paths is permitted, allowing access to the entire filesystem.

Note: changing directory into those locations does not work, but reading files without changing directory does.

Behavior without a profile

n/a

Additional context

Environment

➜ uname -sro
Linux 5.15.8-arch1-1 GNU/Linux

➜ firejail --version
firejail version 0.9.67

Compile time support:
	- always force nonewprivs support is disabled
	- AppArmor support is enabled
	- AppImage support is enabled
	- chroot support is enabled
	- D-BUS proxy support is enabled
	- file transfer support is enabled
	- firetunnel support is enabled
	- networking support is enabled
	- output logging is enabled
	- overlayfs support is disabled
	- private-home support is enabled
	- private-cache and tmpfs as user enabled
	- SELinux support is disabled
	- user namespace support is enabled
	- X11 sandboxing support is enabled

Checklist

(removed some non-applicable items)

I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.

Originally created by @WhyNotHugo on GitHub (Dec 16, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4780 ### Description Using `firejail --private --private-cwd=. /usr/bin/sh` leaks access to the entire filesystem. ### Steps to Reproduce 1. `cd` into some subdirectory of `$HOME`. 2. `firejail --private --private-cwd=. /usr/bin/sh 3. `ls ../../some-file` (for a relative path that exists). `cat` also works. ### Expected behavior Access to these files should not be possible. ### Actual behavior Access to files using relative paths is permitted, allowing access to the entire filesystem. Note: changing directory into those locations does not work, but reading files without changing directory does. ### Behavior without a profile n/a ### Additional context - ### Environment ``` ➜ uname -sro Linux 5.15.8-arch1-1 GNU/Linux ➜ firejail --version firejail version 0.9.67 Compile time support: - always force nonewprivs support is disabled - AppArmor support is enabled - AppImage support is enabled - chroot support is enabled - D-BUS proxy support is enabled - file transfer support is enabled - firetunnel support is enabled - networking support is enabled - output logging is enabled - overlayfs support is disabled - private-home support is enabled - private-cache and tmpfs as user enabled - SELinux support is disabled - user namespace support is enabled - X11 sandboxing support is enabled ``` ### Checklist (removed some non-applicable items) - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers.

gitea-mirror

2026-05-05 09:26:19 -06:00

closed this issue
added the
bug

security
labels

gitea-mirror commented

2026-05-05 09:26:22 -06:00

Author

Owner

@ghost commented on GitHub (Dec 17, 2021):

@WhyNotHugo Nice find! Thanks for reporting.

@rusty-snake I'm new to marking issues to a milestone. Any thoughts on adding this to 0.9.68? Even when this isn't fixed by then (whenever it comes), it's a nice way to keep track of things.

@ghost commented on GitHub (Dec 17, 2021): @WhyNotHugo Nice find! Thanks for reporting. @rusty-snake I'm new to marking issues to a `milestone`. Any thoughts on adding this to [0.9.68](https://github.com/netblue30/firejail/milestone/1)? Even when this isn't fixed by then (whenever it comes), it's a nice way to keep track of things.

gitea-mirror commented

2026-05-05 09:26:23 -06:00

Author

Owner

@netblue30 commented on GitHub (Dec 19, 2021):

Fixed: d2e10f8b72

Very cool bug, thanks!

@netblue30 commented on GitHub (Dec 19, 2021): Fixed: https://github.com/netblue30/firejail/commit/d2e10f8b728eb83f05c1c57cf06a28a6cd48f58f Very cool bug, thanks!

gitea-mirror commented

2026-05-05 09:26:24 -06:00

Author

Owner

@WhyNotHugo commented on GitHub (Dec 20, 2021):

The command in the example above no longer works:

$ firejail --private --private-cwd=. /usr/bin/sh
Error: invalid private working directory

@WhyNotHugo commented on GitHub (Dec 20, 2021): The command in the example above no longer works: ```console $ firejail --private --private-cwd=. /usr/bin/sh Error: invalid private working directory ```

gitea-mirror commented

2026-05-05 09:26:25 -06:00

Author

Owner

@kmk3 commented on GitHub (Dec 23, 2021):

@WhyNotHugo commented on Dec 20:

The command in the example above no longer works:
$ firejail --private --private-cwd=. /usr/bin/sh
Error: invalid private working directory

Hello, could you open a new issue for this?

@kmk3 commented on GitHub (Dec 23, 2021): @WhyNotHugo commented [on Dec 20](https://github.com/netblue30/firejail/issues/4780#issuecomment-998114942): > The command in the example above no longer works: > > ``` > $ firejail --private --private-cwd=. /usr/bin/sh > Error: invalid private working directory > ``` Hello, could you open a new issue for this?

gitea-mirror commented

2026-05-05 09:26:25 -06:00

Author

Owner

@Ding-yixia commented on GitHub (Dec 25, 2023):

这个问题还没有修复

@Ding-yixia commented on GitHub (Dec 25, 2023): 这个问题还没有修复

gitea-mirror referenced this issue

2026-05-05 10:21:43 -06:00

[PR #2778] [MERGED] Sort private-lib #4523

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2778

No description provided.

Rows
Columns