[GH-ISSUE #422] private-bin doesn't use /usr/local/bin

gitea-mirror commented

2026-05-05 05:33:53 -06:00

Owner

Originally created by @ghost on GitHub (Apr 9, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/422

And that's a cool thing, except that it doesn't seem to should do this, because /usr/local/bin isn't in fs_bin.c's paths array.

What I wanted to do is private-bin a program that only resides in my /usr/local/bin and not any of those in the paths array. So that program naturally wasn't found and firejail told me that it's ignoring private-bin for that reason.

So I added /usr/local/bin to the paths array and it worked.
At the same time I noticed something weird. I have another program in both /usr/bin and /usr/local/bin. Before I made any changes to the array, the program from /usr/local/bin was copied to the new bin dir. When I added /usr/local/bin, the version from /usr/bin was copied.

Again;

no /usr/local/bin in paths, but /usr/local/bin version was used, while debug said /usr/bin. (woot)
with /usr/local/bin appended, /usr/bin version was used, debug says /usr/bin. (correct)
with /usr/local/bin prepended, /usr/local/bin version was used, debug says /usr/local/bin, too. (correct)

Originally created by @ghost on GitHub (Apr 9, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/422 And that's a cool thing, except that it doesn't seem to should do this, because `/usr/local/bin` isn't in `fs_bin.c`'s paths array. What I wanted to do is private-bin a program that only resides in my /usr/local/bin and not any of those in the paths array. So that program naturally wasn't found and firejail told me that it's ignoring private-bin for that reason. So I added /usr/local/bin to the paths array and it worked. At the same time I noticed something weird. I have another program in both /usr/bin and /usr/local/bin. Before I made any changes to the array, the program from /usr/local/bin was copied to the new bin dir. When I added /usr/local/bin, the version from /usr/bin was copied. Again; - no `/usr/local/bin` in paths, but `/usr/local/bin` version was used, while debug said `/usr/bin`. (woot) - with `/usr/local/bin` appended, `/usr/bin` version was used, debug says `/usr/bin`. (correct) - with `/usr/local/bin` prepended, `/usr/local/bin` version was used, debug says `/usr/local/bin`, too. (correct)

gitea-mirror

2026-05-05 05:33:53 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 05:33:57 -06:00

Author

Owner

@ghost commented on GitHub (Apr 9, 2016):

Now I see that you already append paths from the PATH variable, but they are two different paths variables.

@ghost commented on GitHub (Apr 9, 2016): Now I see that you already append paths from the PATH variable, but they are two different paths variables.

gitea-mirror commented

2026-05-05 05:33:59 -06:00

Author

Owner

@ghost commented on GitHub (Apr 9, 2016):

And now I know why it copies /usr/bin and still uses the /usr/local/bin version. /usr/local/bin is not modified, except when I add /usr/local/bin to the paths variable, then it's the same as /usr/bin.
So without modifying the paths variable, there are still both versions (and my $PATH prefers /usr/local/bin).

I hope this makes enough sense. I'll play around with it a little more later.

@ghost commented on GitHub (Apr 9, 2016): And now I know why it copies `/usr/bin` and still uses the `/usr/local/bin` version. `/usr/local/bin` is not modified, except when I add `/usr/local/bin` to the paths variable, then it's the same as `/usr/bin`. So without modifying the paths variable, there are still both versions (and my $PATH prefers `/usr/local/bin`). I hope this makes enough sense. I'll play around with it a little more later.

gitea-mirror commented

2026-05-05 05:34:02 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 9, 2016):

I'll look into it, thanks.

@netblue30 commented on GitHub (Apr 9, 2016): I'll look into it, thanks.

gitea-mirror commented

2026-05-05 05:34:04 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 12, 2016):

I added /usr/local/bin in the list in the first position. It will take precedence over /usr/bin or /bin.

@netblue30 commented on GitHub (Apr 12, 2016): I added /usr/local/bin in the list in the first position. It will take precedence over /usr/bin or /bin.

gitea-mirror commented

2026-05-05 05:34:05 -06:00

Author

Owner

@ghost commented on GitHub (Apr 12, 2016):

Main problem confirmed fixed.

What about paths.c:78 and fs.c:504,509? Does anything need to be adjusted there, too? Just making sure nothing is forgotten.

Now, the fix is static priority. Would it be good to build the paths from $PATH, too? So that user's preferences are honored still. Also considering that $PATH may have a directory in $HOME.

@ghost commented on GitHub (Apr 12, 2016): Main problem confirmed fixed. What about `paths.c:78` and `fs.c:504,509`? Does anything need to be adjusted there, too? Just making sure nothing is forgotten. Now, the fix is static priority. Would it be good to build the paths from $PATH, too? So that user's preferences are honored still. Also considering that $PATH may have a directory in $HOME.

gitea-mirror commented

2026-05-05 05:34:08 -06:00

Author

Owner

@ghost commented on GitHub (Apr 12, 2016):

There is also /usr/local/sbin and that's why I think it would be good to use $PATH.

@ghost commented on GitHub (Apr 12, 2016): There is also /usr/local/sbin and that's why I think it would be good to use $PATH.

gitea-mirror commented

2026-05-05 05:34:10 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 12, 2016):

Yes, I added /usr/local/sbin to the list. We cannot allow $PATH in this case, because this will let the user replace system executables with his own version, and take advantage of SUID to attack the system. We can allow only directories owned by root user.

@netblue30 commented on GitHub (Apr 12, 2016): Yes, I added /usr/local/sbin to the list. We cannot allow $PATH in this case, because this will let the user replace system executables with his own version, and take advantage of SUID to attack the system. We can allow only directories owned by root user.

gitea-mirror commented

2026-05-05 05:34:12 -06:00

Author

Owner

@ghost commented on GitHub (Apr 12, 2016):

My main idea was to use $PATH to get the directory priorities as the user wishes, while ignoring $HOME binaries.

@ghost commented on GitHub (Apr 12, 2016): My main idea was to use $PATH to get the directory priorities as the user wishes, while ignoring $HOME binaries.

gitea-mirror commented

2026-05-05 05:34:15 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 13, 2016):

We know about $HOME, but the user can sneak in files from some other places, and it is difficult to process correctly in a SUID executable. This is why I went for a fixed order, with /usr/local/bin before /usr/bin and /bin.

@netblue30 commented on GitHub (Apr 13, 2016): We know about $HOME, but the user can sneak in files from some other places, and it is difficult to process correctly in a SUID executable. This is why I went for a fixed order, with /usr/local/bin before /usr/bin and /bin.

gitea-mirror commented

2026-05-05 05:34:17 -06:00

Author

Owner

@ghost commented on GitHub (Apr 13, 2016):

Then how about using $PATH to only get the correct order of known paths (those we already have hardcoded), and not including new, foreign paths?

@ghost commented on GitHub (Apr 13, 2016): Then how about using $PATH to only get the correct order of known paths (those we already have hardcoded), and not including new, foreign paths?

gitea-mirror commented

2026-05-05 05:34:20 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 14, 2016):

Sure, I'll put it in.

@netblue30 commented on GitHub (Apr 14, 2016): Sure, I'll put it in.

gitea-mirror commented

2026-05-05 05:34:22 -06:00

Author

Owner

@ghost commented on GitHub (Apr 14, 2016):

Awesome.
With /usr/local/bin in I can also contribute suckless.org tools profiles, since those are ideally compiled from source. That's how I found that issue, too.

@ghost commented on GitHub (Apr 14, 2016): Awesome. With /usr/local/bin in I can also contribute suckless.org tools profiles, since those are ideally compiled from source. That's how I found that issue, too.

gitea-mirror commented

2026-05-05 05:34:25 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 15, 2016):

Sure, I'll put it in over the weekend.

@netblue30 commented on GitHub (Apr 15, 2016): Sure, I'll put it in over the weekend.

gitea-mirror referenced this issue

2026-05-05 10:06:27 -06:00

[PR #664] [MERGED] Allow recursive mkdir (Closes #305) #3708

Rows
Columns

[GH-ISSUE #422] private-bin doesn't use /usr/local/bin #305