github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6665] dovecot: errors with disable-exec.inc #3332

New issue

Closed

opened 2026-05-05 09:55:09 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 09:55:09 -06:00

Owner

Originally created by @osevan on GitHub (Feb 25, 2025).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6665

im starting dovecot server rootless and works very well, but, when i include disable-exec i receive errors
even when apparmor not in profile, and journalctl doesnt spits any apparmor errors only this:
Child process initialized in 29.67 ms
Installing /run/firejail/mnt/seccomp/seccomp seccomp filter
Installing /run/firejail/mnt/seccomp/seccomp.block_secondary seccomp filter
/usr/sbin/dovecot: error while loading shared libraries: libdovecot.so.0: failed to map segment from shared object

i did already chown -R dovecot:dovecot /usr/lib/dovecot and noblacklist inside config - before including disable-exec.in - , still not working.

my profile

noblacklist /etc/resolv.conf
noblacklist /etc/dovecot/*
noblacklist /usr/lib/dovecot
noblacklist /usr/bin/doveadm
noblacklist /sbin
noblacklist /usr/sbin
#noblacklist /usr/sbin/*
noblacklist /usr/bin/doveconf
noblacklist /etc/ssl/

include disable-common.inc

include disable-devel.inc
#when i comment out it works else not below .
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-write-mnt.inc
include disable-xdg.inc
include disable-proc.inc
include disable-X11.inc

thanks and

best regards

Originally created by @osevan on GitHub (Feb 25, 2025). Original GitHub issue: https://github.com/netblue30/firejail/issues/6665 im starting dovecot server rootless and works very well, but, when i include disable-exec i receive errors even when apparmor not in profile, and journalctl doesnt spits any apparmor errors only this: Child process initialized in 29.67 ms Installing /run/firejail/mnt/seccomp/seccomp seccomp filter Installing /run/firejail/mnt/seccomp/seccomp.block_secondary seccomp filter /usr/sbin/dovecot: error while loading shared libraries: libdovecot.so.0: failed to map segment from shared object i did already chown -R dovecot:dovecot /usr/lib/dovecot and noblacklist inside config - before including disable-exec.in - , still not working. my profile noblacklist /etc/resolv.conf noblacklist /etc/dovecot/* noblacklist /usr/lib/dovecot noblacklist /usr/bin/doveadm noblacklist /sbin noblacklist /usr/sbin #noblacklist /usr/sbin/* noblacklist /usr/bin/doveconf noblacklist /etc/ssl/ include disable-common.inc include disable-devel.inc #when i comment out it works else not below . include disable-exec.inc include disable-interpreters.inc include disable-programs.inc include disable-write-mnt.inc include disable-xdg.inc include disable-proc.inc include disable-X11.inc thanks and best regards

gitea-mirror

2026-05-05 09:55:09 -06:00

closed this issue
added the
notabug

profile-request
labels

gitea-mirror commented

2026-05-05 09:55:12 -06:00

Author

Owner

@kmk3 commented on GitHub (Feb 25, 2025):

im starting dovecot server rootless and works very well, but, when i include
disable-exec i receive errors

Then don't include it.

Also, dovecot is not supported by firejail.

@kmk3 commented on GitHub (Feb 25, 2025): > im starting dovecot server rootless and works very well, but, when i include > disable-exec i receive errors Then don't include it. Also, dovecot is not supported by firejail.

gitea-mirror commented

2026-05-05 09:55:13 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 25, 2025):

Furthermore noblacklist is documented to ignore blacklist not noexec.

@rusty-snake commented on GitHub (Feb 25, 2025): Furthermore `noblacklist` is documented to ignore `blacklist` not `noexec`.

gitea-mirror commented

2026-05-05 09:55:14 -06:00

Author

Owner

@osevan commented on GitHub (Feb 25, 2025):

@rusty-snake

How i can ignore noexec?

@osevan commented on GitHub (Feb 25, 2025): @rusty-snake How i can ignore noexec?

gitea-mirror commented

2026-05-05 09:55:15 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 25, 2025):

ignore noexec

@rusty-snake commented on GitHub (Feb 25, 2025): `ignore noexec`

gitea-mirror commented

2026-05-05 09:55:15 -06:00

Author

Owner

@osevan commented on GitHub (Feb 26, 2025):

@rusty-snake ,Can I do

ignore noexec /dev/shm?

For more fine granulated profile?

Update
I tested now it works.
Thanks

@osevan commented on GitHub (Feb 26, 2025): @rusty-snake ,Can I do ignore noexec /dev/shm? For more fine granulated profile? Update I tested now it works. Thanks

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3332

No description provided.

Rows
Columns