github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #5899] firecfg: Support OpenDoas #3124

New issue

Closed

opened 2026-05-05 09:45:42 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:45:42 -06:00

Owner

Originally created by @ghost on GitHub (Jul 14, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5899

There was a somewhat recent security vulnerability in sudo leading some users (myself included) to look into projects such as OpenDoas, which is a simpler and easier to audit way of handling privilege escalation that I and some other users in the GNU/Linux community have migrated to. Firecfg does NOT function properly using doas to run, it explicitly requires sudo. When attempting to use doas, it will act as though firecfg was run as the root user, and not as a heightened-privilege user similar to sudo.

Describe the solution you'd like

Perhaps adding an option similar to paru's config file that easily allows Firecfg to be run in "doas mode."

Describe alternatives you've considered

I am not entirely sure if this is something doas is capable of accomplishing, as it is intentionally left as simple as possible. But, I do believe a workaround can be made. I am not a programmer, I'd love to make a pull request if I knew how to add such a feature. 😅

Additional context

Any response is appreciated. :)

Originally created by @ghost on GitHub (Jul 14, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/5899 ### Is your feature request related to a problem? Please describe. There was a somewhat recent [security vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2021-3156) in sudo leading some users (myself included) to look into projects such as [OpenDoas](https://github.com/Duncaen/OpenDoas), which is a simpler and easier to audit way of handling privilege escalation that I and some other users in the GNU/Linux community have migrated to. Firecfg does NOT function properly using `doas` to run, it explicitly requires `sudo`. When attempting to use `doas`, it will act as though `firecfg` was run as the root user, and not as a heightened-privilege user similar to `sudo`. ### Describe the solution you'd like Perhaps adding an option similar to [paru's config file](https://github.com/Morganamilo/paru/blob/master/paru.conf) that easily allows Firecfg to be run in "doas mode." ### Describe alternatives you've considered I am not entirely sure if this is something `doas` is capable of accomplishing, as it is intentionally left as simple as possible. But, I do believe a workaround can be made. I am not a programmer, I'd love to make a pull request if I knew how to add such a feature. 😅 ### Additional context Any response is appreciated. :)

gitea-mirror

2026-05-05 09:45:42 -06:00

closed this issue
added the
enhancement

firecfg
labels

gitea-mirror commented

2026-05-05 09:45:45 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 14, 2023):

OT: https://github.com/Duncaen/OpenDoas/issues/106

Assuming you use doas, can you run doas printenv | grep DOAS_USER and report back if it prints your user.

If so it is a simple second check in c7b8e00c70/src/firecfg/main.c (L292) and c7b8e00c70/src/jailcheck/utils.c (L28).

@rusty-snake commented on GitHub (Jul 14, 2023): OT: https://github.com/Duncaen/OpenDoas/issues/106 --- Assuming you use doas, can you run `doas printenv | grep DOAS_USER` and report back if it prints your user. If so it is a simple second check in https://github.com/netblue30/firejail/blob/c7b8e00c7004473d2a5be902c8bb95636386447c/src/firecfg/main.c#L292 and https://github.com/netblue30/firejail/blob/c7b8e00c7004473d2a5be902c8bb95636386447c/src/jailcheck/utils.c#L28.

gitea-mirror commented

2026-05-05 09:45:46 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 14, 2023):

Nevermind @kmk3 has already done in #5900.

@rusty-snake commented on GitHub (Jul 14, 2023): Nevermind @kmk3 has already done in #5900.

gitea-mirror commented

2026-05-05 09:45:47 -06:00

Author

Owner

@kmk3 commented on GitHub (Jul 16, 2023):

@shaggonit Done in #5900, thanks for the suggestion.

@kmk3 commented on GitHub (Jul 16, 2023): @shaggonit Done in #5900, thanks for the suggestion.

gitea-mirror referenced this issue

2026-05-05 10:24:07 -06:00

[PR #3131] [MERGED] allow chroot syscall where apps depend on QtWebengine #4653

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3124

No description provided.

Rows
Columns