github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6097] chromium: blacklisted paths are accessible (dbus) #3177

New issue

Closed

opened 2026-05-05 09:48:01 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 09:48:01 -06:00

Owner

Originally created by @Lonniebiz on GitHub (Nov 21, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6097

firejail version: 0.9.72
OS: Debian 12
Profile: chromium-browser-privacy.profile

I'm using firejail to run an AppImage of Ungoogled Chromium, which can be downloaded here:
https://ungoogled-software.github.io/ungoogled-chromium-binaries/releases/appimage/64bit/

Specifically, I've download this is the exact file/version:
https://ungoogled-software.github.io/ungoogled-chromium-binaries/releases/appimage/64bit/119.0.6045.123-1

I'm running this AppImage with the following command:
firejail --appimage --profile=/etc/firejail/chromium-browser-privacy.profile /home/user/apps/ungoogled-chromium_119.0.6045.123-1.1.AppImage

Upon running this command, after the browser launches, press ctrl-o. A file dialog will appear, and you can navigate to any file on your computer.

I typically expect firejail profiles to sandbox web browsers, but this profile is not sand-boxed.

Relates to:

#5869

Originally created by @Lonniebiz on GitHub (Nov 21, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/6097 **firejail version:** 0.9.72 **OS:** Debian 12 **Profile:** [chromium-browser-privacy.profile](https://github.com/netblue30/firejail/blob/master/etc/profile-a-l/chromium-browser-privacy.profile) I'm using firejail to run an AppImage of Ungoogled Chromium, which can be downloaded here: https://ungoogled-software.github.io/ungoogled-chromium-binaries/releases/appimage/64bit/ Specifically, I've download this is the exact file/version: https://ungoogled-software.github.io/ungoogled-chromium-binaries/releases/appimage/64bit/119.0.6045.123-1 I'm running this AppImage with the following command: firejail --appimage --profile=/etc/firejail/chromium-browser-privacy.profile /home/user/apps/ungoogled-chromium_119.0.6045.123-1.1.AppImage Upon running this command, after the browser launches, press **ctrl-o**. A file dialog will appear, and **you can navigate to any file on your computer**. I typically expect firejail profiles to sandbox web browsers, but this profile is not sand-boxed. Relates to: * #5869

gitea-mirror

2026-05-05 09:48:01 -06:00

closed this issue
added the
notabug
label

gitea-mirror commented

2026-05-05 09:48:05 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 21, 2023):

profile is not sand-boxed

It is. What you see is the file picker of your Desktop Environment (specifically the xdg-desktop-portal Documents portal implementation)

@rusty-snake commented on GitHub (Nov 21, 2023): > profile is not sand-boxed It is. What you see is the file picker of your Desktop Environment (specifically the xdg-desktop-portal Documents portal implementation)

gitea-mirror commented

2026-05-05 09:48:06 -06:00

Author

Owner

@Lonniebiz commented on GitHub (Nov 21, 2023):

In Firefox, or LibreWolf, if you press alt and then go to File > Open, the sandbox doesn't even allow navigation outside of the sandbox.

In Ungoogled Chromium, with ctrl+o, you can navigate anywhere on the file system, but if you try to open a file outside of the sandbox it fails.

So, the reason for this difference is that Ungoogled Chromium doesn't have its own file picker? Hitting ctrl-o is using your desktop's file picker (which is not sandboxed). It can navigate anywhere, but cannot share with Chromium anything that's outside of the sandbox.

I guess LibreWolf has its own file picker built-in, and that's why that one can't even navigate out of the sandbox.

Is this the correct understanding? @rusty-snake

@Lonniebiz commented on GitHub (Nov 21, 2023): In Firefox, or LibreWolf, if you press alt and then go to **File > Open**, the sandbox doesn't even allow **navigation** outside of the sandbox. In Ungoogled Chromium, with **ctrl+o**, you can navigate anywhere on the file system, but if you try to open a file outside of the sandbox it fails. So, the reason for this difference is that Ungoogled Chromium doesn't have its own file picker? Hitting ctrl-o is using your desktop's file picker (which is not sandboxed). It can navigate anywhere, but cannot share with Chromium anything that's outside of the sandbox. I guess LibreWolf has its own file picker built-in, and that's why that one can't even **navigate** out of the sandbox. Is this the correct understanding? @rusty-snake

gitea-mirror commented

2026-05-05 09:48:06 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 21, 2023):

In short yes.

You can configure Firefox and Firefox.profile to geht the same behaviuor.
It fails to open because the Portal assumes it has access. If x-d-p would support firejail, it would work (dynamically grant permission like in firejail).

@rusty-snake commented on GitHub (Nov 21, 2023): In short yes. - You can configure Firefox and Firefox.profile to geht the same behaviuor. - It fails to open because the Portal assumes it has access. If x-d-p would support firejail, it would work (dynamically grant permission like in firejail).

gitea-mirror commented

2026-05-05 09:48:06 -06:00

Author

Owner

@Lonniebiz commented on GitHub (Nov 22, 2023):

@rusty-snake You mentioned that the Firefox.profile can be configured to exhibit the same behavior. How?

I'd specifically like to try that in LibreWolf to address this issue I have with its built-in file picker. Thanks for the information, and for being such a good shepherd of firejail. I really appreciate it.

@Lonniebiz commented on GitHub (Nov 22, 2023): @rusty-snake You mentioned that the Firefox.profile can be configured to exhibit the same behavior. How? I'd specifically like to try that in [LibreWolf](https://librewolf.net/) to address [this issue I have with its built-in file picker](https://gitlab.com/librewolf-community/browser/appimage/-/issues/18). Thanks for the information, and for being such a good shepherd of firejail. I really appreciate it.

gitea-mirror commented

2026-05-05 09:48:07 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 22, 2023):

Allow dbus access to org.freedesktop.Portal.*, maybe ignore noroot and search on about:config for Portal to find the relevant pref.

@rusty-snake commented on GitHub (Nov 22, 2023): Allow dbus access to `org.freedesktop.Portal.*`, maybe ignore noroot and search on about:config for Portal to find the relevant pref.

gitea-mirror commented

2026-05-05 09:48:07 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 22, 2023):

FF pref: widget.use-xdg-desktop-portal.file-picker=1

@rusty-snake commented on GitHub (Nov 22, 2023): FF pref: `widget.use-xdg-desktop-portal.file-picker=1`

gitea-mirror referenced this issue

2026-05-05 10:24:29 -06:00

[PR #3177] [MERGED] Allow request_key syscall for udiskie #4672

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3177

No description provided.

Rows
Columns