github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6185] Add ${USER} macro (containing username of user who runs the firejail) #3213

New issue

Open

opened 2026-05-05 09:49:34 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:49:34 -06:00

Owner

Originally created by @msva on GitHub (Feb 1, 2024).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6185

Hi there!

Sometimes, when I write profiles for my software, I facing situations when I need to mkdir/mkfile something in, say, /tmp/<username> for example, but I don't want to hardcode username in profiles, and want to make them username-agnostic.

And, as far as I see in fj manpage and in wiki here on GH, there is no such macro that would help me with that.
Much closer thing is ${RUNUSER}, but it links to /run/user/<UID>, while I sometimes need paths exactly containing username.

Would you please add a macro ${USER} (as corresponding variable in shells) or, at least, ${USERNAME} that will contain the username of the current user?

Originally created by @msva on GitHub (Feb 1, 2024). Original GitHub issue: https://github.com/netblue30/firejail/issues/6185 Hi there! Sometimes, when I write profiles for my software, I facing situations when I need to `mkdir`/`mkfile` something in, say, `/tmp/<username>` for example, but I don't want to hardcode username in profiles, and want to make them username-agnostic. And, as far as I see in fj manpage and in wiki here on GH, there is no such macro that would help me with that. Much closer thing is `${RUNUSER}`, but it links to `/run/user/<UID>`, while I sometimes need paths exactly containing username. Would you please add a macro `${USER}` (as corresponding variable in shells) or, at least, `${USERNAME}` that will contain the username of the current user?

gitea-mirror added the

enhancement

label 2026-05-05 09:49:34 -06:00

gitea-mirror commented

2026-05-05 09:49:36 -06:00

Author

Owner

@msva commented on GitHub (Feb 1, 2024):

by the way, maybe it will also be good to add XDG_CACHE_HOME macro (which will inherit corresponding value from environment variable during execution) too (to be able to pre-create cache directory before running the program, whatever value it will have on user's system)

I will hellp to solve issues like

Failed to create /tmp/mva/.cache for shader cache (No such file or directory)---disabling.

When mesa trying to create a place for shaders cache.

@msva commented on GitHub (Feb 1, 2024): by the way, maybe it will also be good to add XDG_CACHE_HOME macro (which will inherit corresponding value from environment variable during execution) too (to be able to pre-create cache directory before running the program, whatever value it will have on user's system) I will hellp to solve issues like ``` Failed to create /tmp/mva/.cache for shader cache (No such file or directory)---disabling. ``` When mesa trying to create a place for shaders cache.

gitea-mirror commented

2026-05-05 09:49:37 -06:00

Author

Owner

@kmk3 commented on GitHub (Feb 1, 2024):

@msva on Feb 1:

Sometimes, when I write profiles for my software, I facing situations when I
need to mkdir/mkfile something in, say, /tmp/<username> for example,
but I don't want to hardcode username in profiles, and want to make them
username-agnostic.

Would you please add a macro ${USER} (as corresponding variable in shells)
or, at least, ${USERNAME} that will contain the username of the current
user?

+1 for ${USER}.

Though note that currently macros are only allowed at the beginning of paths.
The relevant code only handles that case and {} and some other shell
metacharacters are rejected outside of the macro itself. Example:

$ firejail --quiet --noprofile --mkdir='${HOME}/foo'
$ ls -l ~/foo
total 0
$ firejail --quiet --noprofile --mkdir='/tmp/${HOME}'
Error: "/tmp/${HOME}" is an invalid filename: rejected character: "{"

For now I'd suggest using shell script wrappers to create the paths. Example:

~/bin/myprogram:

#!/bin/sh

mkdir -p "/tmp/$USER"
exec firejail --profile=foo /usr/bin/myprogram

@kmk3 commented on GitHub (Feb 1, 2024): @msva [on Feb 1](https://github.com/netblue30/firejail/issues/6185#issue-2111486873): > Sometimes, when I write profiles for my software, I facing situations when I > need to `mkdir`/`mkfile` something in, say, `/tmp/<username>` for example, > but I don't want to hardcode username in profiles, and want to make them > username-agnostic. > Would you please add a macro `${USER}` (as corresponding variable in shells) > or, at least, `${USERNAME}` that will contain the username of the current > user? +1 for `${USER}`. Though note that currently macros are only allowed at the beginning of paths. The relevant code only handles that case and `{}` and some other shell metacharacters are rejected outside of the macro itself. Example: ```console $ firejail --quiet --noprofile --mkdir='${HOME}/foo' $ ls -l ~/foo total 0 $ firejail --quiet --noprofile --mkdir='/tmp/${HOME}' Error: "/tmp/${HOME}" is an invalid filename: rejected character: "{" ``` For now I'd suggest using shell script wrappers to create the paths. Example: ~/bin/myprogram: ```sh #!/bin/sh mkdir -p "/tmp/$USER" exec firejail --profile=foo /usr/bin/myprogram ```

gitea-mirror commented

2026-05-05 09:49:38 -06:00

Author

Owner

@kmk3 commented on GitHub (Feb 1, 2024):

@msva on Feb 1:

by the way, maybe it will also be good to add XDG_CACHE_HOME macro (which
will inherit corresponding value from environment variable during execution)
too (to be able to pre-create cache directory before running the program,
whatever value it will have on user's system)

I will hellp to solve issues like
Failed to create /tmp/mva/.cache for shader cache (No such file or directory)---disabling.
When mesa trying to create a place for shaders cache.

Please open a separate issue for this.

Considering that there is currently support for some XDG-related macros (such
as ${DOCUMENTS}), this may or may not be easier to implement.

Though note that private-cache exists and that it may make more sense to
allow a path argument to it instead (such as private-cache /tmp/mva/.cache in
your example).

Rows
Columns