github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #4994] disable-xdg.inc weirdness with ${DESKTOP} [mupdf and directory whitelist] #2846

New issue

Closed

opened 2026-05-05 09:29:59 -06:00 by gitea-mirror · 9 comments

gitea-mirror commented

2026-05-05 09:29:59 -06:00

Owner

Originally created by @ghost on GitHub (Mar 1, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4994

Originally assigned to: @smitsohu on GitHub.

Discussed in https://github.com/netblue30/firejail/discussions/4975

^{Originally posted by wonbug February 24, 2022}
I'm trying to open a PDF file with mupdf in ~/Desktop/

I put all these directives into ~/.config/firejail/mupdf.local:

whitelist ${HOME}/Desktop/
whitelist ${HOME}/Desktop
whitelist ~/Desktop/
whitelist ~/Desktop

Yet when I try to open the file, I get:

$ /usr/bin/firejail /usr/bin/mupdf ~/Desktop/file.pdf
...
error: cannot open /home/user/Desktop/file.pdf: Permission denied
mupdf: error: cannot open document

Am I missing something obvious?

Originally created by @ghost on GitHub (Mar 1, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/4994 Originally assigned to: @smitsohu on GitHub. ### Discussed in https://github.com/netblue30/firejail/discussions/4975 <div type='discussions-op-text'> <sup>Originally posted by **wonbug** February 24, 2022</sup> I'm trying to open a PDF file with `mupdf` in `~/Desktop/` I put all these directives into `~/.config/firejail/mupdf.local`: ``` whitelist ${HOME}/Desktop/ whitelist ${HOME}/Desktop whitelist ~/Desktop/ whitelist ~/Desktop ``` Yet when I try to open the file, I get: ``` $ /usr/bin/firejail /usr/bin/mupdf ~/Desktop/file.pdf ... error: cannot open /home/user/Desktop/file.pdf: Permission denied mupdf: error: cannot open document ``` Am I missing something obvious?</div>

gitea-mirror

2026-05-05 09:29:59 -06:00

closed this issue
added the
bug

security
labels

gitea-mirror commented

2026-05-05 09:30:03 -06:00

Author

Owner

@ghost commented on GitHub (Mar 1, 2022):

Users are reporting problems with disable-xdg.inc that might be a bug: https://github.com/netblue30/firejail/discussions/4975#discussioncomment-2269810.

@ghost commented on GitHub (Mar 1, 2022): Users are reporting problems with `disable-xdg.inc` that might be a bug: https://github.com/netblue30/firejail/discussions/4975#discussioncomment-2269810.

gitea-mirror commented

2026-05-05 09:30:04 -06:00

Author

Owner

@smitsohu commented on GitHub (Mar 3, 2022):

I can reproduce this. Definitely a bug!

@smitsohu commented on GitHub (Mar 3, 2022): I can reproduce this. Definitely a bug!

gitea-mirror commented

2026-05-05 09:30:05 -06:00

Author

Owner

@smitsohu commented on GitHub (Mar 3, 2022):

You guys don't have a ~/.config/user-dirs.dirs right?

@smitsohu commented on GitHub (Mar 3, 2022): You guys don't have a `~/.config/user-dirs.dirs` right?

gitea-mirror commented

2026-05-05 09:30:06 -06:00

Author

Owner

@ghost commented on GitHub (Mar 4, 2022):

You guys don't have a ~/.config/user-dirs.dirs right?

As stated in #4975 my ~/Desktop is symlinked to /mnt/foo/bar and I have a one-liner disable-xdg.local containing blacklist ${DESKTOP}. I do have ~/.config/user-dirs.dirs. The below command runs just fine here and output is exactly the same as without firejail:

$ firejail --quiet --ignore='include disable-xdg.local' /usr/bin/mupdf ~/Desktop/file.pdf
error: cannot find startxref
warning: trying to repair broken xref
warning: repairing PDF document
[file.pdf is opened]

Curious to hear the OP's and @crocket's answers to your question.

@ghost commented on GitHub (Mar 4, 2022): > You guys don't have a ~/.config/user-dirs.dirs right? As stated in #4975 my ~/Desktop is symlinked to /mnt/foo/bar _and_ I have a one-liner disable-xdg.local containing `blacklist ${DESKTOP}`. I do have ~/.config/user-dirs.dirs. The below command runs just fine here and output is exactly the same as without firejail: ```console $ firejail --quiet --ignore='include disable-xdg.local' /usr/bin/mupdf ~/Desktop/file.pdf error: cannot find startxref warning: trying to repair broken xref warning: repairing PDF document [file.pdf is opened] ``` Curious to hear the OP's and @crocket's answers to your question.

gitea-mirror commented

2026-05-05 09:30:07 -06:00

Author

Owner

@crocket commented on GitHub (Mar 4, 2022):

You guys don't have a ~/.config/user-dirs.dirs right?

I don't have it.

@crocket commented on GitHub (Mar 4, 2022): > You guys don't have a ~/.config/user-dirs.dirs right? I don't have it.

gitea-mirror commented

2026-05-05 09:30:09 -06:00

Author

Owner

@smitsohu commented on GitHub (Mar 4, 2022):

Adding security label as it is conceivable that this leads to whitelisting a wrong path (only macros). I don't think there are other real life security implications.

@smitsohu commented on GitHub (Mar 4, 2022): Adding security label as it is conceivable that this leads to whitelisting a wrong path (only macros). I don't think there are other real life security implications.

gitea-mirror commented

2026-05-05 09:30:09 -06:00

Author

Owner

@crocket commented on GitHub (Jun 21, 2022):

Is this really fixed?

@crocket commented on GitHub (Jun 21, 2022): Is this really fixed?

gitea-mirror commented

2026-05-05 09:30:10 -06:00

Author

Owner

@smitsohu commented on GitHub (Jul 12, 2022):

@crocket I was under the impression.

Do you still run into this issue? If yes, there is a second problem lurking (and we should reopen).

@smitsohu commented on GitHub (Jul 12, 2022): @crocket I was under the impression. Do you still run into this issue? If yes, there is a second problem lurking (and we should reopen).

gitea-mirror commented

2026-05-05 09:30:11 -06:00

Author

Owner

@crocket commented on GitHub (Jul 12, 2022):

I tested it. The issue seems fixed.

@crocket commented on GitHub (Jul 12, 2022): I tested it. The issue seems fixed.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2846

No description provided.

Rows
Columns