github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

tests mode #2952

New issue

Closed

opened 2026-05-05 09:37:01 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 09:37:01 -06:00

Owner

Originally created by @linqingping on GitHub (Aug 10, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5308

When using --private=/home/tests mode

Describe the solution you'd like

When using --private=/home/tests mode I want to process that only the sandbox has permission to access the /home/test, but does not allow copy and move

Originally created by @linqingping on GitHub (Aug 10, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5308 ### Is your feature request related to a problem? Please describe. When using --private=/home/tests mode ### Describe the solution you'd like When using --private=/home/tests mode I want to process that only the sandbox has permission to access the /home/test, but does not allow copy and move

gitea-mirror

2026-05-05 09:37:01 -06:00

closed this issue
added the
stale

needinfo
labels

gitea-mirror commented

2026-05-05 09:37:03 -06:00

Author

Owner

@ghost commented on GitHub (Aug 10, 2022):

When using --private=/home/tests mode I want to process that only the sandbox has permission to access the /home/test, but does not allow copy and copy

Can you rephrase what you mean by not allow copy and copy please? Or give a more descriptive example...

@ghost commented on GitHub (Aug 10, 2022): > When using --private=/home/tests mode I want to process that only the sandbox has permission to access the /home/test, but does not allow copy and copy Can you rephrase what you mean by `not allow copy and copy` please? Or give a more descriptive example...

gitea-mirror commented

2026-05-05 09:37:04 -06:00

Author

Owner

@linqingping commented on GitHub (Aug 11, 2022):

使用--private=/home/tests模式时我想处理只有沙箱有权限访问/home/test，但不允许复制复制

你能改写你的意思not allow copy and copy吗？或者举一个更具描述性的例子......

Thanks for the reply, I hope that my /home/test directory is only allowed to be used by the sandbox, and no other applications are allowed to open and access it.In other words, it can encrypt the data in the /home/test directory, and it can be opened normally in the /home/test directory. Once the file leaves the /hmoe/test directory, the data will not be available.

@linqingping commented on GitHub (Aug 11, 2022): > > 使用--private=/home/tests模式时我想处理只有沙箱有权限访问/home/test，但不允许复制复制 > > 你能改写你的意思`not allow copy and copy`吗？或者举一个更具描述性的例子...... Thanks for the reply, I hope that my /home/test directory is only allowed to be used by the sandbox, and no other applications are allowed to open and access it.In other words, it can encrypt the data in the /home/test directory, and it can be opened normally in the /home/test directory. Once the file leaves the /hmoe/test directory, the data will not be available.

gitea-mirror commented

2026-05-05 09:37:05 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 11, 2022):

I don't really get want you want to say. Anyway some notes to better understand.

(file) access permissions and encryption are two independent things. The one is enforced by an higher privileged actor (i.e. the Kernel) and the other by Mathematics.
Firejail has no encryption support at all.
The threat model of firejail (tries to) protect the OS from the code running inside the sandbox and not the other way around.
To give a sandboxed program access to an (non-tmpfs based) filesystem tree it have to be accessible by the user. Everything else would be an privileged escalation vulnerability.

@rusty-snake commented on GitHub (Aug 11, 2022): I don't really get want you want to say. Anyway some notes to better understand. 1. (file) access permissions and encryption are two independent things. The one is enforced by an higher privileged actor (i.e. the Kernel) and the other by Mathematics. 2. Firejail has no encryption support at all. 3. The threat model of firejail (tries to) protect the OS from the code running inside the sandbox and not the other way around. 4. To give a sandboxed program access to an (non-tmpfs based) filesystem tree it have to be accessible by the user. Everything else would be an privileged escalation vulnerability.

gitea-mirror commented

2026-05-05 09:37:05 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 30, 2022):

I'm closing here due to inactivity, please fell free to request to reopen if you have more questions.

@rusty-snake commented on GitHub (Oct 30, 2022): I'm closing here due to inactivity, please fell free to request to reopen if you have more questions.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2952

No description provided.

Rows
Columns