github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #5807] recoll: blacklisted paths are accessible (dbus) #3097

New issue

Closed

opened 2026-05-05 09:44:10 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:44:10 -06:00

Owner

Originally created by @Rosika2 on GitHub (Apr 26, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5807

Hi all, 👋

I have a question about running recoll in firejail.

BTW: "whatis recoll" says: "user interface for the Recoll full text search system"

I see firejail doesn´t come with a dedicated recoll profile. So when running recoll in firejail it makes use of the default profile:

firejail recoll
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Warning: networking feature is disabled in Firejail configuration file

** Note: you can use --noprofile to disable default.profile **
[...]

O.K., that´s what I understand so far.

Now for my example:

I want recoll to search for a particular file. It finds it and comes up with the search result. It´s the text-file I was looking for. Here´s what the process tree looks like in firetools:

11823:rosika::firejail recoll 
    11824:rosika::firejail recoll 
        11827:rosika::/usr/bin/fish -c 'recoll' 
            11832:rosika::recoll

Now: within the recoll GUI I have the chance of opening the text-file by double-clicking on "open".
In my case gedit opens the required text file, but it doesn´t run within the firejail sandbox:

ps aux | grep gedit
rosika     12739  9.3  1.4 761380 57600 ?        Sl   14:38   0:02 /usr/bin/gedit --gapplication-service
rosika     12874  0.0  0.0   9428  2284 pts/9    S+   14:38   0:00 grep --color=auto gedit

I was of the opinion that any process triggered by another process which is already running within firejail is also sandboxed. 🤔

Perhaps I´m missing something here. Can anybody help ❓

Many thanks in advance and many greetings

Rosika 🙂

P.S.

my system: Linux Lite 6.2
firejail version 0.9.66

Originally created by @Rosika2 on GitHub (Apr 26, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/5807 Hi all, :wave: I have a question about running `recoll` in firejail. BTW: "whatis recoll" says: "user interface for the Recoll full text search system" I see `firejail` doesn´t come with a dedicated recoll profile. So when running `recoll` in firejail it makes use of the _default profile_: ``` firejail recoll Reading profile /etc/firejail/default.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc Warning: networking feature is disabled in Firejail configuration file ** Note: you can use --noprofile to disable default.profile ** [...] ``` O.K., that´s what I understand so far. Now for my example: I want `recoll` to search for a particular file. It finds it and comes up with the search result. It´s the text-file I was looking for. Here´s what the process tree looks like in `firetools`: ``` 11823:rosika::firejail recoll 11824:rosika::firejail recoll 11827:rosika::/usr/bin/fish -c 'recoll' 11832:rosika::recoll ``` Now: within the recoll GUI I have the chance of opening the text-file by double-clicking on "open". In my case `gedit` opens the required text file, but _it doesn´t run within the firejail sandbox_: ``` ps aux | grep gedit rosika 12739 9.3 1.4 761380 57600 ? Sl 14:38 0:02 /usr/bin/gedit --gapplication-service rosika 12874 0.0 0.0 9428 2284 pts/9 S+ 14:38 0:00 grep --color=auto gedit ``` I was of the opinion that any process triggered by another process which is already running within firejail is also sandboxed. :thinking: Perhaps I´m missing something here. Can anybody help :question: Many thanks in advance and many greetings Rosika :slightly_smiling_face: P.S. my system: Linux Lite 6.2 firejail version 0.9.66

gitea-mirror

2026-05-05 09:44:10 -06:00

closed this issue
added the
notabug
label

gitea-mirror commented

2026-05-05 09:44:14 -06:00

Author

Owner

@kmk3 commented on GitHub (Apr 26, 2023):

firejail version 0.9.66

Note that we do not maintain that version of firejail:

https://github.com/netblue30/firejail/blob/master/SECURITY.md

Versions other than the latest usually have outdated profiles and may contain
bugs and security vulnerabilities that were fixed in later versions.

See also:

https://github.com/netblue30/firejail#installing

@kmk3 commented on GitHub (Apr 26, 2023): > firejail version 0.9.66 Note that we do not maintain that version of firejail: * <https://github.com/netblue30/firejail/blob/master/SECURITY.md> Versions other than the latest usually have outdated profiles and may contain bugs and security vulnerabilities that were fixed in later versions. See also: * <https://github.com/netblue30/firejail#installing>

gitea-mirror commented

2026-05-05 09:44:15 -06:00

Author

Owner

@kmk3 commented on GitHub (Apr 26, 2023):

I see firejail doesn´t come with a dedicated recoll profile. So when
running recoll in firejail it makes use of the default profile:

I want recoll to search for a particular file. It finds it and comes up
with the search result. It´s the text-file I was looking for. Here´s what the
process tree looks like in firetools:

Now: within the recoll GUI I have the chance of opening the text-file by
double-clicking on "open". In my case gedit opens the required text file,
but it doesn´t run within the firejail sandbox:
ps aux | grep gedit
rosika     12739  9.3  1.4 761380 57600 ?        Sl   14:38   0:02 /usr/bin/gedit --gapplication-service
rosika     12874  0.0  0.0   9428  2284 pts/9    S+   14:38   0:00 grep --color=auto gedit
I was of the opinion that any process triggered by another process which is
already running within firejail is also sandboxed. thinking

Note that default.profile does not block dbus, which is one way to get around
the sandbox restrictions.

In fact, default.profile offers little to no protection at all, so I'd suggest
to try to create a profile for recoll. See the following for details:

https://github.com/netblue30/firejail/wiki/Creating-Profiles#steps-for-contributing-your-own-profile

@kmk3 commented on GitHub (Apr 26, 2023): > I see `firejail` doesn´t come with a dedicated recoll profile. So when > running `recoll` in firejail it makes use of the _default profile_: > I want `recoll` to search for a particular file. It finds it and comes up > with the search result. It´s the text-file I was looking for. Here´s what the > process tree looks like in `firetools`: > Now: within the recoll GUI I have the chance of opening the text-file by > double-clicking on "open". In my case `gedit` opens the required text file, > but _it doesn´t run within the firejail sandbox_: > > ``` > ps aux | grep gedit > rosika 12739 9.3 1.4 761380 57600 ? Sl 14:38 0:02 /usr/bin/gedit --gapplication-service > rosika 12874 0.0 0.0 9428 2284 pts/9 S+ 14:38 0:00 grep --color=auto gedit > ``` > > I was of the opinion that any process triggered by another process which is > already running within firejail is also sandboxed. thinking Note that default.profile does not block dbus, which is one way to get around the sandbox restrictions. In fact, default.profile offers little to no protection at all, so I'd suggest to try to create a profile for `recoll`. See the following for details: * <https://github.com/netblue30/firejail/wiki/Creating-Profiles#steps-for-contributing-your-own-profile>

gitea-mirror commented

2026-05-05 09:44:15 -06:00

Author

Owner

@Rosika2 commented on GitHub (Apr 26, 2023):

@kmk3 :

Thanks, Kelvin, for your answer.

Well, I installed firejail from the standard Ubuntu repositories, which Linux Lite makes use of, I guess.
I´ll add the firejail PPA in due course in order to get the latest version.

Note that default.profile does not block dbus, which is one way to get around
the sandbox restrictions.

Ah, that´s the explanation then.
Thanks for the link. I´ll try to create a profile for recoll with it.

Many thanks for your help and many greetings
Rosika 🙂

@Rosika2 commented on GitHub (Apr 26, 2023): @kmk3 : Thanks, Kelvin, for your answer. Well, I installed firejail from the standard Ubuntu repositories, which Linux Lite makes use of, I guess. I´ll add the firejail PPA in due course in order to get the latest version. > Note that default.profile does not block dbus, which is one way to get around > the sandbox restrictions. Ah, that´s the explanation then. Thanks for the link. I´ll try to create a profile for recoll with it. Many thanks for your help and many greetings Rosika :slightly_smiling_face:

gitea-mirror referenced this issue

2026-05-05 10:23:56 -06:00

[PR #3097] [MERGED] profiles: firecfg: disable CLI archivers #4643

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3097

No description provided.

Rows
Columns