[GH-ISSUE #5877] nextcloud: cannot access ~/Nextcloud/Notes

gitea-mirror commented

2026-05-05 09:45:16 -06:00

Owner

Originally created by @Sadoon-AlBader on GitHub (Jul 2, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5877

Description

The default settings allow NC to only access the parent directory ${HOME}/Nextcloud and not any of its subdirs.

Steps to Reproduce

No errors, in command line, Nextcloud complains that it cannot access i.e. "{HOME}/Nextcloud/Notes"
Verified that it can access {HOME}/Nextcloud by commenting out "noblacklist {HOME}/Nextcloud" and it gives a different error.

Expected behavior

It should have access to all subdirs by default

Actual behavior

No access to any subdirs.

Behavior without a profile

Works just fine.

Environment

Debian Bookworm on x86_64 with AppArmor Firejail profile enabled.
firejail version 0.9.72 (from repo)

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Not necessary, no log errors.

I think all we need is a * after the Nextcloud, either that or my configuration is hopelessly broken. All other programs seems to work fine though and I have no custom settings from what I can tell. Thanks for this software btw!

Originally created by @Sadoon-AlBader on GitHub (Jul 2, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/5877 ### Description The default settings allow NC to only access the parent directory ${HOME}/Nextcloud and not any of its subdirs. ### Steps to Reproduce No errors, in command line, Nextcloud complains that it cannot access i.e. "{HOME}/Nextcloud/Notes" Verified that it can access {HOME}/Nextcloud by commenting out "noblacklist {HOME}/Nextcloud" and it gives a different error. ### Expected behavior It should have access to all subdirs by default ### Actual behavior No access to any subdirs. ### Behavior without a profile Works just fine. ### Environment - Debian Bookworm on x86_64 with AppArmor Firejail profile enabled. - firejail version 0.9.72 (from repo) ### Checklist - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log Not necessary, no log errors. I think all we need is a * after the Nextcloud, either that or my configuration is hopelessly broken. All other programs seems to work fine though and I have no custom settings from what I can tell. Thanks for this software btw!

gitea-mirror

2026-05-05 09:45:16 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 09:45:19 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 2, 2023):

I think all we need is a * after the Nextcloud

Just test and know.

@rusty-snake commented on GitHub (Jul 2, 2023): > **I think** all we need is a * after the Nextcloud Just test and know.

gitea-mirror commented

2026-05-05 09:45:20 -06:00

Author

Owner

@Sadoon-AlBader commented on GitHub (Jul 2, 2023):

I think all we need is a * after the Nextcloud

Just test and know.

Ah my bad, forgot to mention I already tried the solution I mentioned in a nextcloud.local config and it works fine.
I'd send a patch but I want to make sure this is not just affecting me before messing with it everyone else's configs :)

@Sadoon-AlBader commented on GitHub (Jul 2, 2023): > > **I think** all we need is a * after the Nextcloud > > Just test and know. Ah my bad, forgot to mention I already tried the solution I mentioned in a nextcloud.local config and it works fine. I'd send a patch but I want to make sure this is not just affecting me before messing with it everyone else's configs :)

gitea-mirror commented

2026-05-05 09:45:21 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 2, 2023):

Actually you only need to noblacklist

33c75b8932/etc/inc/disable-programs.inc (L1189)

@rusty-snake commented on GitHub (Jul 2, 2023): Actually you only need to `noblacklist` https://github.com/netblue30/firejail/blob/33c75b89328df03ef3245c7ec6f30759f9619223/etc/inc/disable-programs.inc#L1189

gitea-mirror commented

2026-05-05 09:45:22 -06:00

Author

Owner

@Sadoon-AlBader commented on GitHub (Jul 2, 2023):

Actually you only need to noblacklist

33c75b8932/etc/inc/disable-programs.inc (L1189)

Ah strange, I'd never assumed that /Notes specifically would be blacklisted in a general include file, my bad.

Edit: Although it does make perfect sense to not blacklist that folder in Nextcloud's config by default.

@Sadoon-AlBader commented on GitHub (Jul 2, 2023): > Actually you only need to `noblacklist` > > https://github.com/netblue30/firejail/blob/33c75b89328df03ef3245c7ec6f30759f9619223/etc/inc/disable-programs.inc#L1189 Ah strange, I'd never assumed that /Notes specifically would be blacklisted in a general include file, my bad. Edit: Although it does make perfect sense to not blacklist that folder in Nextcloud's config by default.

gitea-mirror commented

2026-05-05 09:45:22 -06:00

Author

Owner

@kmk3 commented on GitHub (Jul 4, 2023):

Edit: Nevermind this comment, the diff looks OK:

https://github.com/netblue30/firejail/issues/5877#issuecomment-1620645804

@rusty-snake on Jul 2:

Actually you only need to noblacklist

33c75b8932/etc/inc/disable-programs.inc (L1189)

$ git log --pretty='%h %ai %s' -S/Nextcloud/Notes master
590f66171 2019-04-24 12:25:36 -0400 Revert "Merge branch 'master' of github.com:netblue30/firejail"
7c481eb43 2018-10-20 22:13:13 -0500 Add QOwnNotes profile

~~That line~~ The noblacklist line existed but it seems to have been removed
in a merge commit that accidentally truncated some files. The merge commit was
followed by its revert, which did not restore the affected line:

7c481eb43 ("Add QOwnNotes profile", 2018-10-20) by @Fred-Barclay
0d42e12f1 ("Merge branch 'master' of github.com:netblue30/firejail",
2019-04-24) by @rusty-snake
590f66171 ("Revert "Merge branch 'master' of github.com:netblue30/firejail"",
2019-04-24) by @SkewedZeppelin

$ git log --oneline --graph 78f1e3a035..590f661715
* 590f66171 Revert "Merge branch 'master' of github.com:netblue30/firejail"
*   0d42e12f1 Merge branch 'master' of github.com:netblue30/firejail
|\
| * 6e8ba04da blacklist .git-credential & .config/git (#2663) …
* | 63efb454a blacklist .git-credentials & .config/git (#2663) …
|/
* bb5e52040 Arch Linux fixes

This seems a bit worrying, as more changes might have been lost.

Does anyone remember what happened there?

I might look into this later.

@kmk3 commented on GitHub (Jul 4, 2023): **Edit**: Nevermind this comment, the diff looks OK: * <https://github.com/netblue30/firejail/issues/5877#issuecomment-1620645804> --- @rusty-snake [on Jul 2](https://github.com/netblue30/firejail/issues/5877#issuecomment-1616809777): > Actually you only need to `noblacklist` > > https://github.com/netblue30/firejail/blob/33c75b89328df03ef3245c7ec6f30759f9619223/etc/inc/disable-programs.inc#L1189 ```console $ git log --pretty='%h %ai %s' -S/Nextcloud/Notes master 590f66171 2019-04-24 12:25:36 -0400 Revert "Merge branch 'master' of github.com:netblue30/firejail" 7c481eb43 2018-10-20 22:13:13 -0500 Add QOwnNotes profile ``` ~~That line~~ The `noblacklist` line existed but it seems to have been removed in a merge commit that accidentally truncated some files. The merge commit was followed by its revert, which did not restore the affected line: * 7c481eb43 ("Add QOwnNotes profile", 2018-10-20) by @Fred-Barclay * 0d42e12f1 ("Merge branch 'master' of github.com:netblue30/firejail", 2019-04-24) by @rusty-snake * 590f66171 ("Revert "Merge branch 'master' of github.com:netblue30/firejail"", 2019-04-24) by @SkewedZeppelin ```console $ git log --oneline --graph 78f1e3a035..590f661715 * 590f66171 Revert "Merge branch 'master' of github.com:netblue30/firejail" * 0d42e12f1 Merge branch 'master' of github.com:netblue30/firejail |\ | * 6e8ba04da blacklist .git-credential & .config/git (#2663) … * | 63efb454a blacklist .git-credentials & .config/git (#2663) … |/ * bb5e52040 Arch Linux fixes ``` This seems a bit worrying, as more changes might have been lost. Does anyone remember what happened there? I might look into this later.

gitea-mirror commented

2026-05-05 09:45:23 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 4, 2023):

I don't know what your talking about the line was restored in the revert (590f661715 (diff-de6116e8cecbb92d4cb33c3294352b83db4bf33a48306f6f862e51d4c7181f91R7)) and it exists on current master (https://github.com/netblue30/firejail/blob/master/etc/inc/disable-programs.inc#L1189).

@rusty-snake commented on GitHub (Jul 4, 2023): I don't know what your talking about the line was restored in the revert (https://github.com/netblue30/firejail/commit/590f661715c991af40fb2de8b5bfe3b2bf2a606c#diff-de6116e8cecbb92d4cb33c3294352b83db4bf33a48306f6f862e51d4c7181f91R7) and it exists on current master (https://github.com/netblue30/firejail/blob/master/etc/inc/disable-programs.inc#L1189).

gitea-mirror commented

2026-05-05 09:45:25 -06:00

Author

Owner

@kmk3 commented on GitHub (Jul 4, 2023):

I don't know what your talking about the line was restored in the revert
(590f661#diff-de6116e8cecbb92d4cb33c3294352b83db4bf33a48306f6f862e51d4c7181f91R7)
and it exists on current master
(https://github.com/netblue30/firejail/blob/master/etc/inc/disable-programs.inc#L1189).

Sorry, I meant the noblacklist ${HOME}/Nextcloud/Notes that you suggested:

https://github.com/netblue30/firejail/commit/7c481eb43c3a737eeb5a0e4fc089efa281549e4c#diff-3c43e1d54bf310a5825d2fa517bcff3ac1de5eb97415c12e62104658f75939feR10

@kmk3 commented on GitHub (Jul 4, 2023): > I don't know what your talking about the line was restored in the revert > ([590f661#diff-de6116e8cecbb92d4cb33c3294352b83db4bf33a48306f6f862e51d4c7181f91R7](https://github.com/netblue30/firejail/commit/590f661715c991af40fb2de8b5bfe3b2bf2a606c#diff-de6116e8cecbb92d4cb33c3294352b83db4bf33a48306f6f862e51d4c7181f91R7)) > and it exists on current master > (https://github.com/netblue30/firejail/blob/master/etc/inc/disable-programs.inc#L1189). Sorry, I meant the `noblacklist ${HOME}/Nextcloud/Notes` that you suggested: * <https://github.com/netblue30/firejail/commit/7c481eb43c3a737eeb5a0e4fc089efa281549e4c#diff-3c43e1d54bf310a5825d2fa517bcff3ac1de5eb97415c12e62104658f75939feR10>

gitea-mirror commented

2026-05-05 09:45:25 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 4, 2023):

Neither nextcloud.profile nor QOwnNotes.profile are touched in the commits above.

@rusty-snake commented on GitHub (Jul 4, 2023): Neither nextcloud.profile nor QOwnNotes.profile are touched in the commits above.

gitea-mirror commented

2026-05-05 09:45:26 -06:00

Author

Owner

@kmk3 commented on GitHub (Jul 4, 2023):

Neither nextcloud.profile nor QOwnNotes.profile are touched in the commits
above.

Sorry, please disregard all that. It seems that I confused the
commands/outputs. The diff from before the merge/after the revert looks
normal:

git diff

$ git diff --stat bb5e52040c..590f661715
 etc/android-studio.profile | 2 ++
 etc/aosp.profile           | 2 ++
 etc/atom.profile           | 2 ++
 etc/brackets.profile       | 2 ++
 etc/clion.profile          | 2 ++
 etc/code.profile           | 2 ++
 etc/disable-programs.inc   | 2 ++
 etc/geany.profile          | 2 ++
 etc/gedit.profile          | 2 ++
 etc/git.profile            | 2 ++
 etc/gitg.profile           | 2 ++
 etc/github-desktop.profile | 4 +++-
 etc/gnome-builder.profile  | 2 ++
 etc/idea.sh.profile        | 2 ++
 etc/meld.profile           | 2 ++
 etc/webstorm.profile       | 2 ++
 16 files changed, 33 insertions(+), 1 deletion(-)

The git log -S command was wrong; the search also counted the blacklist
command. This is more accurate:

$ git log --pretty='%h %ai %s' -S'noblacklist ${HOME}/Nextcloud/Notes' master
f43382f1e 2021-07-18 20:39:14 -0300 Revert "move whitelist/blacklist to allow/deny"
fe0f975f4 2021-07-05 07:23:31 -0400 move whitelist/blacklist to allow/deny
7c481eb43 2018-10-20 22:13:13 -0500 Add QOwnNotes profile

The noblacklist ${HOME}/Nextcloud/Notes line is still in that profile:

https://github.com/netblue30/firejail/blob/5d0822c52c9a5e631676899e9642911d9143dba8/etc/profile-m-z/QOwnNotes.profile#L10

So I suppose that it only needs to be copied to nextcloud.profile then.

@kmk3 commented on GitHub (Jul 4, 2023): > Neither nextcloud.profile nor QOwnNotes.profile are touched in the commits > above. Sorry, please disregard all that. It seems that I confused the commands/outputs. The diff from before the merge/after the revert looks normal: <details> <summary>git diff</summary> <p> ```console $ git diff --stat bb5e52040c..590f661715 etc/android-studio.profile | 2 ++ etc/aosp.profile | 2 ++ etc/atom.profile | 2 ++ etc/brackets.profile | 2 ++ etc/clion.profile | 2 ++ etc/code.profile | 2 ++ etc/disable-programs.inc | 2 ++ etc/geany.profile | 2 ++ etc/gedit.profile | 2 ++ etc/git.profile | 2 ++ etc/gitg.profile | 2 ++ etc/github-desktop.profile | 4 +++- etc/gnome-builder.profile | 2 ++ etc/idea.sh.profile | 2 ++ etc/meld.profile | 2 ++ etc/webstorm.profile | 2 ++ 16 files changed, 33 insertions(+), 1 deletion(-) ``` </p> </details> The `git log -S` command was wrong; the search also counted the `blacklist` command. This is more accurate: ```console $ git log --pretty='%h %ai %s' -S'noblacklist ${HOME}/Nextcloud/Notes' master f43382f1e 2021-07-18 20:39:14 -0300 Revert "move whitelist/blacklist to allow/deny" fe0f975f4 2021-07-05 07:23:31 -0400 move whitelist/blacklist to allow/deny 7c481eb43 2018-10-20 22:13:13 -0500 Add QOwnNotes profile ``` The `noblacklist ${HOME}/Nextcloud/Notes` line is still in that profile: * <https://github.com/netblue30/firejail/blob/5d0822c52c9a5e631676899e9642911d9143dba8/etc/profile-m-z/QOwnNotes.profile#L10> So I suppose that it only needs to be copied to nextcloud.profile then.

gitea-mirror referenced this issue

2026-05-05 10:24:01 -06:00

[PR #3120] [MERGED] Gentoo fixes #4648