github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6447] mkdir command works even when the path is blacklisted #3276

New issue

Closed

opened 2026-05-05 09:52:52 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 09:52:52 -06:00

Owner

Originally created by @elde-n on GitHub (Aug 23, 2024).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6447

The mkdir command in a profile file bypasses nowhitelist and blacklist override

Example:
test.local

nowhitelist ${HOME}/test
blacklist ${HOME}/test

test.profile

mkdir ${HOME}/test

Originally created by @elde-n on GitHub (Aug 23, 2024). Original GitHub issue: https://github.com/netblue30/firejail/issues/6447 The mkdir command in a profile file bypasses nowhitelist and blacklist override Example: `test.local` ```sh nowhitelist ${HOME}/test blacklist ${HOME}/test ``` `test.profile` ```sh mkdir ${HOME}/test ```

gitea-mirror

2026-05-05 09:52:52 -06:00

closed this issue
added the
notabug
label

gitea-mirror commented

2026-05-05 09:52:55 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 23, 2024):

It does not bypass them because it can not "bypass" them. You can not protect firejail from firejail with firejail.

So what's going on

nowhitelist ${HOME}/test
mkdir ${HOME}/test

Firejail sees two commands, one asking to ignore any following whitelist ${HOME}/test command. And one command asking to create a directory at ${HOME}/test.
One could say mkdir should respect a nowhitelist like it should for --private= (which has a bug and does not respect --private=). But see the next.

blacklist ${HOME}/test
mkdir ${HOME}/test

Firejail sees two commands, one asking to blackist ${HOME}/test if it exists. And one command asking to create a directory at ${HOME}/test.
While this order isn't very useful, flipping these two lines can make a different between a sandbox escape and blocking it.

@rusty-snake commented on GitHub (Aug 23, 2024): It does not bypass them because it can not "bypass" them. You can not protect firejail from firejail with firejail. So what's going on 1. ``` nowhitelist ${HOME}/test mkdir ${HOME}/test ``` Firejail sees two commands, one asking to ignore any following `whitelist ${HOME}/test` command. And one command asking to create a directory at `${HOME}/test`. One could say mkdir should respect a `nowhitelist` like it should for `--private=` (which has a bug and does not respect `--private=`). But see the next. 2. ``` blacklist ${HOME}/test mkdir ${HOME}/test ``` Firejail sees two commands, one asking to blackist `${HOME}/test` *if it exists*. And one command asking to create a directory at `${HOME}/test`. While this order isn't very useful, flipping these two lines can make a different between a sandbox escape and blocking it.

gitea-mirror commented

2026-05-05 09:52:56 -06:00

Author

Owner

@elde-n commented on GitHub (Aug 23, 2024):

Well how would I avoid calling mkdir in a default profile?
For example the default neomutt profile creates 6 trash directories in the home directory that are never used on my system

@elde-n commented on GitHub (Aug 23, 2024): Well how would I avoid calling mkdir in a default profile? For example the default neomutt profile creates 6 trash directories in the home directory that are never used on my system

gitea-mirror commented

2026-05-05 09:52:57 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 23, 2024):

Add ignore mkdir <PATH> to your neomutt.local.

@rusty-snake commented on GitHub (Aug 23, 2024): Add `ignore mkdir <PATH>` to your `neomutt.local`.

gitea-mirror commented

2026-05-05 09:52:58 -06:00

Author

Owner

@elde-n commented on GitHub (Aug 23, 2024):

Thank you it's exactly what I was looking for!

@elde-n commented on GitHub (Aug 23, 2024): Thank you it's exactly what I was looking for!

gitea-mirror referenced this issue

2026-05-05 10:25:05 -06:00

[PR #3276] [MERGED] seccomp: allow defining separate filters for 32-bit arch #4706

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3276

No description provided.

Rows
Columns