[GH-ISSUE #5694] Fvwm "Restart" creates directory outside `--private` or `--overlay-tmpfs` sandbox? #3068

New issue

Open

opened 2026-05-05 09:42:36 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 09:42:36 -06:00

Owner

Originally created by @laniakea64 on GitHub (Feb 27, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5694

Environment

Xubuntu 22.04
firejail self build from 4201eb4f7a

$ firejail --version
firejail version 0.9.73

Compile time support:
        - always force nonewprivs support is disabled
        - AppArmor support is enabled
        - AppImage support is enabled
        - chroot support is enabled
        - D-BUS proxy support is enabled
        - file transfer support is enabled
        - firetunnel support is disabled
        - IDS support is disabled
        - networking support is enabled
        - output logging is enabled
        - overlayfs support is disabled
        - private-home support is enabled
        - private-cache and tmpfs as user enabled
        - SELinux support is disabled
        - user namespace support is enabled
        - X11 sandboxing support is enabled

firejail X11 sandboxing uses Xephyr on this system.

Steps to reproduce

on a system that does not have an existing ~/.fvwm directory, run

firejail --x11 --private --noprofile fvwm2

confirm that ~/.fvwm exists inside the sandbox but not outside it
open Fvwm menu > Restart

Expected results: Fvwm either restarts or quits, and the real filesystem should not be modified.

Actual results:

Fvwm quits. An empty directory ~/.fvwm is created on the real filesystem, outside the sandbox. Owner & group are both my user, and mode is 0755.

Wondered if I might be missing something in the sandboxing, but same thing happens with firejail --x11 --private --noprofile --dbus-user=none --dbus-system=none --net=none --caps.drop=all --seccomp fvwm2.

Same results occur with --overlay-tmpfs (with modified firejail build to allow this) instead of using --private.

Using Fvwm menu > Quit instead of Restart does not reproduce this behavior.

Originally created by @laniakea64 on GitHub (Feb 27, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/5694 **Environment** Xubuntu 22.04 firejail self build from 4201eb4f7ac4bb765bdf30f4a3e934d66d5d8103 ``` $ firejail --version firejail version 0.9.73 Compile time support: - always force nonewprivs support is disabled - AppArmor support is enabled - AppImage support is enabled - chroot support is enabled - D-BUS proxy support is enabled - file transfer support is enabled - firetunnel support is disabled - IDS support is disabled - networking support is enabled - output logging is enabled - overlayfs support is disabled - private-home support is enabled - private-cache and tmpfs as user enabled - SELinux support is disabled - user namespace support is enabled - X11 sandboxing support is enabled ``` firejail X11 sandboxing uses Xephyr on this system. **Steps to reproduce** 1) on a system that does not have an existing `~/.fvwm` directory, run ``` firejail --x11 --private --noprofile fvwm2 ``` 2) confirm that `~/.fvwm` exists inside the sandbox but not outside it 3) open Fvwm menu > Restart **Expected results:** Fvwm either restarts or quits, and the real filesystem should not be modified. **Actual results:** Fvwm quits. An empty directory `~/.fvwm` is created on the real filesystem, outside the sandbox. Owner & group are both my user, and mode is 0755. Wondered if I might be missing something in the sandboxing, but same thing happens with `firejail --x11 --private --noprofile --dbus-user=none --dbus-system=none --net=none --caps.drop=all --seccomp fvwm2`. Same results occur with `--overlay-tmpfs` (with modified firejail build to allow this) instead of using `--private`. Using Fvwm menu > Quit instead of Restart does not reproduce this behavior.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3068

No description provided.

Rows
Columns

[GH-ISSUE #5694] Fvwm "Restart" creates directory outside --private or --overlay-tmpfs sandbox? #3068

[GH-ISSUE #5694] Fvwm "Restart" creates directory outside `--private` or `--overlay-tmpfs` sandbox? #3068