[GH-ISSUE #6490] Reintroduce shell feature

gitea-mirror commented

2026-05-05 09:53:36 -06:00

Owner

Originally created by @ganeshjkale on GitHub (Sep 27, 2024).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6490

#OS : Redhat 9.4
#Firejail : v0.9.72
#Command
firejail --shell=/bin/rbash --profile=/etc/firejail/abc.profile /usr/bin/gedit
firejail --shell=/bin/rbash /usr/bin/gedit
firejail --shell=/bin/rbash --noprofile /usr/bin/gedit

shell feature enables to provide more security , not able to find its alternative and documentation.
please help

Originally created by @ganeshjkale on GitHub (Sep 27, 2024). Original GitHub issue: https://github.com/netblue30/firejail/issues/6490 #OS : Redhat 9.4 #Firejail : v0.9.72 #Command firejail --shell=/bin/rbash --profile=/etc/firejail/abc.profile /usr/bin/gedit firejail --shell=/bin/rbash /usr/bin/gedit firejail --shell=/bin/rbash --noprofile /usr/bin/gedit shell feature enables to provide more security , not able to find its alternative and documentation. please help

gitea-mirror added the

enhancement

needinfo

labels 2026-05-05 09:53:36 -06:00

gitea-mirror commented

2026-05-05 09:53:37 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 27, 2024):

What do you mean with shell feature?

Why does it provide more security?

@rusty-snake commented on GitHub (Sep 27, 2024): What do you mean with shell feature? Why does it provide more security?

gitea-mirror commented

2026-05-05 09:53:38 -06:00

Author

Owner

@kmk3 commented on GitHub (Sep 27, 2024):

Basic information is missing; please follow the feature request template:

https://github.com/netblue30/firejail/issues/new?template=feature_request.md

@kmk3 commented on GitHub (Sep 27, 2024): Basic information is missing; please follow the feature request template: * <https://github.com/netblue30/firejail/issues/new?template=feature_request.md>

gitea-mirror commented

2026-05-05 09:53:40 -06:00

Author

Owner

@ganeshjkale commented on GitHub (Sep 27, 2024):

For eg. combine firejail with rbash or custom shell

@ganeshjkale commented on GitHub (Sep 27, 2024): For eg. combine firejail with rbash or custom shell

gitea-mirror commented

2026-05-05 09:53:40 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 27, 2024):

firejail rbash?

You need to explain in more detail.

@rusty-snake commented on GitHub (Sep 27, 2024): `firejail rbash`? You need to explain in more detail.

gitea-mirror commented

2026-05-05 09:53:41 -06:00

Author

Owner

@ganeshjkale commented on GitHub (Sep 27, 2024):

Firejail v0.9.70 below command.
firejail --shell=/bin/rbash application

@ganeshjkale commented on GitHub (Sep 27, 2024): Firejail v0.9.70 below command. firejail --shell=/bin/rbash application

gitea-mirror commented

2026-05-05 09:53:41 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 27, 2024):

And why is a --shell required? Why not simply firejail /bin/rbash application?

@rusty-snake commented on GitHub (Sep 27, 2024): And why is a `--shell` required? Why not simply `firejail /bin/rbash application`?

gitea-mirror commented

2026-05-05 09:53:42 -06:00

Author

Owner

@ganeshjkale commented on GitHub (Sep 27, 2024):

#not working getting cannot execute binary gedit.
firejail /bin/rbash gedit

#working
firejail gedit

@ganeshjkale commented on GitHub (Sep 27, 2024): #not working getting cannot execute binary gedit. firejail /bin/rbash gedit #working firejail gedit

gitea-mirror commented

2026-05-05 09:53:42 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 27, 2024):

Maybe you should outline why you even need/want a rbash.

not working getting cannot execute binary gedit

firejail /bin/bash -r -c gedit

@rusty-snake commented on GitHub (Sep 27, 2024): Maybe you should outline why you even need/want a rbash. > not working getting cannot execute binary gedit `firejail /bin/bash -r -c gedit`

gitea-mirror commented

2026-05-05 09:53:43 -06:00

Author

Owner

@luitzifa commented on GitHub (Nov 19, 2024):

IMHO this is a regression introduced in 0.9.72. The --shell feature was removed here: https://github.com/netblue30/firejail/issues/5190
The feature is needed to use firejail directly as login shell.
This issue is somewhat related to https://github.com/netblue30/firejail/issues/6206

@luitzifa commented on GitHub (Nov 19, 2024): IMHO this is a regression introduced in 0.9.72. The --shell feature was removed here: https://github.com/netblue30/firejail/issues/5190 The feature is needed to use firejail directly as login shell. This issue is somewhat related to https://github.com/netblue30/firejail/issues/6206

gitea-mirror commented

2026-05-05 09:53:43 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 19, 2024):

A small wrapper (e.g. firejail-sh) would fit this better IMHO.

@rusty-snake commented on GitHub (Nov 19, 2024): A small wrapper (e.g. `firejail-sh`) would fit this better IMHO.

gitea-mirror commented

2026-05-05 09:53:43 -06:00

Author

Owner

@luitzifa commented on GitHub (Nov 19, 2024):

I cannot get a wrapper like

root@notebook:~# cat /usr/local/bin/firejail-login.sh
#!/bin/sh
/usr/bin/firejail --quiet --profile=/etc/firejail/myprofile.profile /bin/bash

to work with something like this:
ssh -o IdentityAgent=none testuser2@127.0.0.1 'ls /dev'

I can login and execute the command, but i need to be able to execute the command directly over ssh in firejail.

@luitzifa commented on GitHub (Nov 19, 2024): I cannot get a wrapper like ``` root@notebook:~# cat /usr/local/bin/firejail-login.sh #!/bin/sh /usr/bin/firejail --quiet --profile=/etc/firejail/myprofile.profile /bin/bash ``` to work with something like this: `ssh -o IdentityAgent=none testuser2@127.0.0.1 'ls /dev'` I can login and execute the command, but i need to be able to execute the command directly over ssh in firejail.

gitea-mirror commented

2026-05-05 09:53:44 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 19, 2024):

Passing arguments could help. Untested:

#!/bin/sh
exec /usr/bin/firejail --quiet --profile=/etc/firejail/myprofile.profile /bin/bash -- "$@"

@rusty-snake commented on GitHub (Nov 19, 2024): Passing arguments could help. Untested: ```bash #!/bin/sh exec /usr/bin/firejail --quiet --profile=/etc/firejail/myprofile.profile /bin/bash -- "$@" ```

gitea-mirror commented

2026-05-05 09:53:44 -06:00

Author

Owner

@luitzifa commented on GitHub (Nov 21, 2024):

I tested your wrapper. Did not work :( , also the login is broken too.

❯ ssh -o IdentityAgent=none testuser@127.0.0.1
testuser@127.0.0.1's password:
Welcome to Ubuntu 24.04.1 LTS (GNU/Linux 6.8.0-49-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

Last login: Thu Nov 21 10:24:21 2024 from 127.0.0.1
/bin/bash: -c: No such file or directory
Connection to 127.0.0.1 closed.
❯ ssh -o IdentityAgent=none testuser@127.0.0.1 'ls /dev'
testuser@127.0.0.1's password:
/bin/bash: -c: No such file or directory

@luitzifa commented on GitHub (Nov 21, 2024): I tested your wrapper. Did not work :( , also the login is broken too. ``` ❯ ssh -o IdentityAgent=none testuser@127.0.0.1 testuser@127.0.0.1's password: Welcome to Ubuntu 24.04.1 LTS (GNU/Linux 6.8.0-49-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro Last login: Thu Nov 21 10:24:21 2024 from 127.0.0.1 /bin/bash: -c: No such file or directory Connection to 127.0.0.1 closed. ❯ ssh -o IdentityAgent=none testuser@127.0.0.1 'ls /dev' testuser@127.0.0.1's password: /bin/bash: -c: No such file or directory ```

gitea-mirror commented

2026-05-05 09:53:45 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 21, 2024):

If passing non-file-arguments to bash is required, remove the --.

@rusty-snake commented on GitHub (Nov 21, 2024): If passing non-file-arguments to bash is required, remove the `--`.

gitea-mirror commented

2026-05-05 09:53:45 -06:00

Author

Owner

@luitzifa commented on GitHub (Nov 21, 2024):

That did the trick. I will test it further:

❯ cat /usr/local/bin/firejail-login.sh
#!/bin/sh
/usr/bin/firejail --quiet --profile=/etc/firejail/myloginshell.profile /bin/bash "$@"
❯ grep testuser /etc/passwd
testuser:x:994:981::/home/testuser:/usr/local/bin/firejail-login.sh
testuser2:x:993:980::/home/testuser2:/usr/bin/firejail
❯ ssh -o IdentityAgent=none testuser@127.0.0.1 'ls -la /dev | grep random'
testuser@127.0.0.1's password:
crw-rw-rw-   1 nobody nogroup   1, 8 Nov 21 10:35 random
crw-rw-rw-   1 nobody nogroup   1, 9 Nov 21 10:35 urandom

Thanks

@luitzifa commented on GitHub (Nov 21, 2024): That did the trick. I will test it further: ``` ❯ cat /usr/local/bin/firejail-login.sh #!/bin/sh /usr/bin/firejail --quiet --profile=/etc/firejail/myloginshell.profile /bin/bash "$@" ❯ grep testuser /etc/passwd testuser:x:994:981::/home/testuser:/usr/local/bin/firejail-login.sh testuser2:x:993:980::/home/testuser2:/usr/bin/firejail ❯ ssh -o IdentityAgent=none testuser@127.0.0.1 'ls -la /dev | grep random' testuser@127.0.0.1's password: crw-rw-rw- 1 nobody nogroup 1, 8 Nov 21 10:35 random crw-rw-rw- 1 nobody nogroup 1, 9 Nov 21 10:35 urandom ``` Thanks

Rows
Columns

[GH-ISSUE #6490] Reintroduce shell feature #3290