github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #5107] [Website Text Amends] What is SUID, and how does it affect me? #2881

New issue

Closed

opened 2026-05-05 09:32:31 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 09:32:31 -06:00

Owner

Originally created by @Foemass on GitHub (Apr 15, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5107

Originally assigned to: @netblue30 on GitHub.

The following line of text in What is SUID, and how does it affect me could be misleading:

"If you are not using Chromium or a browser based on Chromium (Opera, etc.) turn on force-nonewprivs flag in /etc/firejail/firejail.config file."

I'm informed (by this discussion here: https://github.com/netblue30/firejail/discussions/5106) that Chromium actually works fine with force-nonewprivs yes set. UNLESS you've set kernel.unprivileged_userns_clone=0 or are on one of the very few distros which have it configured like that by default. So for many people there's no reason to be warned off simply because they use Chromium.

Describe the solution you'd like

I don't really know what I'm talking about, but in the interest of trying to be helpful here's how I'd restructure the text.

3. Set force-nonewprivs flag

Turn on force-nonewprivs flag in /etc/firejail/firejail.config file. As root, open the file in a text editor and add this line:

force-nonewprivs yes

The flag prevents rising privileges after the sandbox was started. It is believed to clean most SUID problems that will ever be attributed to Firejail.

Note you should avoid doing this if you use a Chromium-based browser and have set kernel.unprivileged_userns_clone=0 (or are on one of the few distros which do this by default.) Unfortunately, Chromium-based browsers need to rise privileges in order to install their own SUID sandbox.

Describe alternatives you've considered

As previously mentioned I basically don't know what I'm talking about, so consider this with a HUGE handful of salt.

But I'm getting the impression that for most users, setting force-nonewprivs yes provides a slither of extra security with no negative ramifications. So maybe you could just make that the default?

Originally created by @Foemass on GitHub (Apr 15, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5107 Originally assigned to: @netblue30 on GitHub. ### Is your feature request related to a problem? Please describe. The following line of text in [What is SUID, and how does it affect me](https://firejail.wordpress.com/documentation-2/basic-usage/#suid) could be misleading: > "If you are not using Chromium or a browser based on Chromium (Opera, etc.) turn on force-nonewprivs flag in /etc/firejail/firejail.config file." I'm informed (by this discussion here: https://github.com/netblue30/firejail/discussions/5106) that Chromium actually works fine with force-nonewprivs yes set. UNLESS you've set `kernel.unprivileged_userns_clone=0` or are on one of the very few distros which have it configured like that by default. So for many people there's no reason to be warned off simply because they use Chromium. ### Describe the solution you'd like I don't really know what I'm talking about, but in the interest of trying to be helpful here's how I'd restructure the text. > **3. Set force-nonewprivs flag** > > Turn on force-nonewprivs flag in /etc/firejail/firejail.config file. As root, open the file in a text editor and add this line: > > > `force-nonewprivs yes` > > The flag prevents rising privileges after the sandbox was started. It is believed to clean most SUID problems that will ever be attributed to Firejail. > > Note you should avoid doing this if you use a Chromium-based browser and have set kernel.unprivileged_userns_clone=0 (or are on one of the few distros which do this by default.) Unfortunately, Chromium-based browsers need to rise privileges in order to install their own SUID sandbox. ### Describe alternatives you've considered As previously mentioned I basically don't know what I'm talking about, so consider this with a HUGE handful of salt. But I'm getting the impression that for most users, setting `force-nonewprivs yes` provides a slither of extra security with no negative ramifications. So maybe you could just make that the default?

gitea-mirror

2026-05-05 09:32:31 -06:00

closed this issue
added the
wordpress
label

gitea-mirror commented

2026-05-05 09:32:35 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 15, 2022):

Suggestion for the last paragraph, the rest looks good:

Note that this breaks Chromium-based software on systems where kernel.unprivileged_userns_clone=0 is set and other programs which need to raise privileges such as wireshark or virtualbox.

@rusty-snake commented on GitHub (Apr 15, 2022): Suggestion for the last paragraph, the rest looks good: > Note that this breaks Chromium-based software on systems where `kernel.unprivileged_userns_clone=0` is set and other programs which need to raise privileges such as wireshark or virtualbox.

gitea-mirror commented

2026-05-05 09:32:36 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 15, 2022):

But I'm getting the impression that for most users, setting force-nonewprivs yes provides a slither of extra security with no negative ramifications. So maybe you could just make that the default?

We would need to remove programs like wireshark from firecfg.config and detect ernel.unprivileged_userns_clone=0.

If we do so we should use force-nonewprivs auto-yes for this detection and force-nonewprivs yes to set it unconditional.

@rusty-snake commented on GitHub (Apr 15, 2022): > But I'm getting the impression that for most users, setting force-nonewprivs yes provides a slither of extra security with no negative ramifications. So maybe you could just make that the default? We would need to remove programs like wireshark from firecfg.config and detect `ernel.unprivileged_userns_clone=0`. If we do so we should use `force-nonewprivs auto-yes` for this detection and `force-nonewprivs yes` to set it unconditional.

gitea-mirror commented

2026-05-05 09:32:37 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 15, 2022):

As a FYI, firejail-welcome.sh ask to set force-nonewprivs yes when asking for "advanced options".

@rusty-snake commented on GitHub (Apr 15, 2022): As a FYI, [firejail-welcome.sh](https://github.com/netblue30/firejail/blob/master/contrib/firejail-welcome.sh) ask to set `force-nonewprivs yes` when asking for "advanced options".

gitea-mirror commented

2026-05-05 09:32:38 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 17, 2022):

Fixed on the web page, thanks!

@netblue30 commented on GitHub (Apr 17, 2022): Fixed on the web page, thanks!

gitea-mirror commented

2026-05-05 09:32:38 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 17, 2022):

ITurn on force-nonewprivs flag …

typo: remove leading I

@rusty-snake commented on GitHub (Apr 17, 2022): > ITurn on force-nonewprivs flag … typo: remove leading `I`

gitea-mirror commented

2026-05-05 09:32:38 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 21, 2022):

Found it, thanks!

@netblue30 commented on GitHub (Apr 21, 2022): Found it, thanks!

gitea-mirror referenced this issue

2026-05-05 10:22:33 -06:00

[PR #2881] [MERGED] Add Zulip profile #4567

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2881

No description provided.

Rows
Columns