[GH-ISSUE #5518] firefox: permissive access to /etc

gitea-mirror commented

2026-05-05 09:40:21 -06:00

Owner

Originally created by @Boruch-Baum on GitHub (Dec 9, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5518

Running firejail for firefox-esr in debian allows me to read any file under /etc using keybinding C-o. That seems needlessly permissive to me. I created a firefox-esr.local file with the following contents that seem to fix the issue for me personally without any noticeable undesirable side-effects so far, but you may want to consider it for universal use

whitelist /etc/firefox-esr
whitelist /etc/mailcap*
blacklist /etc

Originally created by @Boruch-Baum on GitHub (Dec 9, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5518 Running firejail for firefox-esr in debian allows me to read any file under /etc using keybinding C-o. That seems needlessly permissive to me. I created a firefox-esr.local file with the following contents that seem to fix the issue for me personally without any noticeable undesirable side-effects so far, but you may want to consider it for universal use whitelist /etc/firefox-esr whitelist /etc/mailcap* blacklist /etc

gitea-mirror

2026-05-05 09:40:21 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 09:40:23 -06:00

Author

Owner

@rusty-snake commented on GitHub (Dec 9, 2022):

Why do you whitelist stuff in /etc if you blacklist entire /etc?
What about resolv.conf
There's a comment in firefox.profile about private-etc, if you test on all distros with all possible configurations, we can enabled it.

@rusty-snake commented on GitHub (Dec 9, 2022): 1. Why do you whitelist stuff in `/etc` if you blacklist entire `/etc`? 2. What about `resolv.conf` 3. There's a comment in firefox.profile about `private-etc`, if you test on all distros with all possible configurations, we can enabled it.

gitea-mirror commented

2026-05-05 09:40:25 -06:00

Author

Owner

@Boruch-Baum commented on GitHub (Dec 9, 2022):

On 2022-12-09 04:16, rusty-snake wrote:

1. Why do you whitelist stuff in /etc if you blacklist entire /etc?

Because those two sub-folders are used by firefox

2. What about resolv.conf

Because firefox isn't directly doing DNS

3. There's a comment in firefox.profile about private-etc, if you test
   on all distros with all possible configurations, we can enabled it.

Oooh. I wasn't familiar with that feature, and with that option. So the
way to test it in debian would be to replace the contents of my firefox
local with that line, right? I'll do that now, and complain if any
trouble arises.

—
Reply to this email directly, [1]view it on GitHub, or [2]unsubscribe.
You are receiving this because you authored the thread. Message ID:
@.***>

References

https://github.com/netblue30/firejail/issues/5518#issuecomment-1344236979

https://github.com/notifications/unsubscribe-auth/AAOE3KDF5VZNZAFMLQDIMGDWMMPKRANCNFSM6AAAAAASZGEUF4

--
hkp://keys.gnupg.net
CA45 09B5 5351 7C11 A9D1 7286 0036 9E45 1595 8BC0

@Boruch-Baum commented on GitHub (Dec 9, 2022): On 2022-12-09 04:16, rusty-snake wrote: > 1. Why do you whitelist stuff in /etc if you blacklist entire /etc? Because those two sub-folders are used by firefox > 2. What about resolv.conf Because firefox isn't directly doing DNS > 3. There's a comment in firefox.profile about private-etc, if you test > on all distros with all possible configurations, we can enabled it. Oooh. I wasn't familiar with that feature, and with that option. So the way to test it in debian would be to replace the contents of my firefox local with that line, right? I'll do that now, and complain if any trouble arises. > > — > Reply to this email directly, [1]view it on GitHub, or [2]unsubscribe. > You are receiving this because you authored the thread. Message ID: > ***@***.***> > > References > > 1. https://github.com/netblue30/firejail/issues/5518#issuecomment-1344236979 > 2. https://github.com/notifications/unsubscribe-auth/AAOE3KDF5VZNZAFMLQDIMGDWMMPKRANCNFSM6AAAAAASZGEUF4 -- hkp://keys.gnupg.net CA45 09B5 5351 7C11 A9D1 7286 0036 9E45 1595 8BC0

gitea-mirror commented

2026-05-05 09:40:26 -06:00

Author

Owner

@rusty-snake commented on GitHub (Dec 9, 2022):

Because those two sub-folders are used by firefox

But how can firejail use them if it can not access them?

@rusty-snake commented on GitHub (Dec 9, 2022): > Because those two sub-folders are used by firefox But how can firejail use them if it can not access them?

gitea-mirror commented

2026-05-05 09:40:27 -06:00

Author

Owner

@Boruch-Baum commented on GitHub (Dec 9, 2022):

OK. As an initial follow-up about your default private-etc:

it's missing an entry for a firefox-esr folder, which in debian has
some system-wide default settings
it has some entries that I'm surprised are legitimately needed ever
by firefox:

group
hostname
machine-id
passwd
it has some entries that I suspect firefox itself doesn't need
because the related functionality is handled by OS components:

alternatives
hosts
nssswitch.conf
resolv.conf
selinux
ssl
X11
it also has some entries for which firefox maintains its own data
internally, so also likely is unnecessary:

ca-certificates
crypto-policies
many of the other items I'm unsure about, so for now, I'm testing in
debian with just the following:

private-etc firefox-esr,mailcap,mime.types

--
hkp://keys.gnupg.net
CA45 09B5 5351 7C11 A9D1 7286 0036 9E45 1595 8BC0

@Boruch-Baum commented on GitHub (Dec 9, 2022): OK. As an initial follow-up about your default private-etc: 1) it's missing an entry for a firefox-esr folder, which in debian has some system-wide default settings 2) it has some entries that I'm surprised are legitimately needed ever by firefox: group hostname machine-id passwd 3) it has some entries that I suspect firefox itself doesn't need because the related functionality is handled by OS components: alternatives hosts nssswitch.conf resolv.conf selinux ssl X11 4) it also has some entries for which firefox maintains its own data internally, so also likely is unnecessary: ca-certificates crypto-policies 5) many of the other items I'm unsure about, so for now, I'm testing in debian with just the following: private-etc firefox-esr,mailcap,mime.types -- hkp://keys.gnupg.net CA45 09B5 5351 7C11 A9D1 7286 0036 9E45 1595 8BC0

gitea-mirror commented

2026-05-05 09:40:28 -06:00

Author

Owner

@Boruch-Baum commented on GitHub (Dec 18, 2022):

I've been using a custom firefox-esr.local file for about a week now, and I can report that the following works fine for me:

private-etc firefox-esr,fonts,mailcap,mime.types

Note that I needed to add 'fonts' to my original proposal, and also that I did not test using firefox without mailcap or mime.types

@Boruch-Baum commented on GitHub (Dec 18, 2022): I've been using a custom firefox-esr.local file for about a week now, and I can report that the following works fine for me: private-etc firefox-esr,fonts,mailcap,mime.types Note that I needed to add 'fonts' to my original proposal, and also that I did not test using firefox without mailcap or mime.types

gitea-mirror commented

2026-05-05 09:40:29 -06:00

Author

Owner

@layderv commented on GitHub (Jan 11, 2023):

I've been using a custom firefox-esr.local file for about a week now, and I can report that the following works fine for me:

private-etc firefox-esr,fonts,mailcap,mime.types

Note that I needed to add 'fonts' to my original proposal, and also that I did not test using firefox without mailcap or mime.types

Did you have to edit settings in Firefox? With a default profile, I need to allow resolv.conf too

@layderv commented on GitHub (Jan 11, 2023): > I've been using a custom firefox-esr.local file for about a week now, and I can report that the following works fine for me: > > private-etc firefox-esr,fonts,mailcap,mime.types > > Note that I needed to add 'fonts' to my original proposal, and also that I did not test using firefox without mailcap or mime.types Did you have to edit settings in Firefox? With a default profile, I need to allow resolv.conf too

gitea-mirror commented

2026-05-05 09:40:29 -06:00

Author

Owner

@Boruch-Baum commented on GitHub (Jan 12, 2023):

I don't remember making that change, using Debian's firefox-esr
--version "Mozilla Firefox 102.6.0esr". Firefox can be a kind of 'moving
target' in that they change defaults, and Debian puts their own layer of
patches on everything. With that in mind: From firefox's 'about:config'
tab, when I search for 'dns' and 'resolv' I see no changes to the
default settings (firefox would display such lines in bold). From the
command-line, I could have grepped file prefs.js, I guess.

I am glad you mentioned the DNS issue, because it's a subject that I'm
finding confusing on one of my machines. See, in addition to using
firejail, I'm using a application firewall called 'opensnitch', and I
notice that it is logging port 53 and 443 events from firefox to a bunch
of websites with names that sound like resolvers, for instance:

mozilla.cloudflare-dns.com
doh.test
use-application-dns.net

However, the events aren't anywhere near frequent enough to be
individual DNS queries, even considering a firefox local DNS cache. It
could be, though, that firefox is keeping a single DOH 443 connection
active for as long as firefox remains open, which sounds sensible to me,
but I don't know if that's how firefox DOH works, and opensnitch is also
logging firefox port 53 event to localhost and a bunch of other destinations.

On 2023-01-11 14:23, layderv wrote:

 I've been using a custom firefox-esr.local file for about a week
 now, and I can report that the following works fine for me:

 private-etc firefox-esr,fonts,mailcap,mime.types

 Note that I needed to add 'fonts' to my original proposal, and also
 that I did not test using firefox without mailcap or mime.types
Did you have to edit settings in Firefox? With a default profile, I
need to allow resolv.conf too

—
Reply to this email directly, [1]view it on GitHub, or [2]unsubscribe.
You are receiving this because you authored the thread. Message ID:
@.***>

References

https://github.com/netblue30/firejail/issues/5518#issuecomment-1379562223

https://github.com/notifications/unsubscribe-auth/AAOE3KGZPWAMGJCVL3JRN3DWR4XGJANCNFSM6AAAAAASZGEUF4

--
hkp://keys.gnupg.net
CA45 09B5 5351 7C11 A9D1 7286 0036 9E45 1595 8BC0

@Boruch-Baum commented on GitHub (Jan 12, 2023): I don't remember making that change, using Debian's firefox-esr --version "Mozilla Firefox 102.6.0esr". Firefox can be a kind of 'moving target' in that they change defaults, and Debian puts their own layer of patches on everything. With that in mind: From firefox's 'about:config' tab, when I search for 'dns' and 'resolv' I see no changes to the default settings (firefox would display such lines in bold). From the command-line, I could have grepped file prefs.js, I guess. I am glad you mentioned the DNS issue, because it's a subject that I'm finding confusing on one of my machines. See, in addition to using firejail, I'm using a application firewall called 'opensnitch', and I notice that it is logging port 53 and 443 events from firefox to a bunch of websites with names that sound like resolvers, for instance: mozilla.cloudflare-dns.com doh.test use-application-dns.net However, the events aren't anywhere near frequent enough to be individual DNS queries, even considering a firefox local DNS cache. It could be, though, that firefox is keeping a single DOH 443 connection active for as long as firefox remains open, which sounds sensible to me, but I don't know if that's how firefox DOH works, and opensnitch is also logging firefox port 53 event to localhost and a bunch of other destinations. On 2023-01-11 14:23, layderv wrote: > I've been using a custom firefox-esr.local file for about a week > now, and I can report that the following works fine for me: > > private-etc firefox-esr,fonts,mailcap,mime.types > > Note that I needed to add 'fonts' to my original proposal, and also > that I did not test using firefox without mailcap or mime.types > > Did you have to edit settings in Firefox? With a default profile, I > need to allow resolv.conf too > > — > Reply to this email directly, [1]view it on GitHub, or [2]unsubscribe. > You are receiving this because you authored the thread. Message ID: > ***@***.***> > > References > > 1. https://github.com/netblue30/firejail/issues/5518#issuecomment-1379562223 > 2. https://github.com/notifications/unsubscribe-auth/AAOE3KGZPWAMGJCVL3JRN3DWR4XGJANCNFSM6AAAAAASZGEUF4 -- hkp://keys.gnupg.net CA45 09B5 5351 7C11 A9D1 7286 0036 9E45 1595 8BC0

gitea-mirror commented

2026-05-05 09:40:30 -06:00

Author

Owner

@kmk3 commented on GitHub (Aug 23, 2024):

private-etc is now enabled in firefox-common:

#6435

Closing as resolved.

Feel free to open a new issue for bugs or improvements.

@kmk3 commented on GitHub (Aug 23, 2024): private-etc is now enabled in firefox-common: * #6435 Closing as resolved. Feel free to open a new issue for bugs or improvements.

gitea-mirror referenced this issue

2026-05-05 10:23:24 -06:00

[PR #3019] [MERGED] Slack profile: use temporary cache #4615

Rows
Columns

[GH-ISSUE #5518] firefox: permissive access to /etc #3019