[GH-ISSUE #6746] Provide an option to mount the top directory temporary filesystem of a whitelisted directory without the noexec flag #3356

New issue

Open

opened 2026-05-05 09:56:16 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 09:56:16 -06:00

Owner

Originally created by @saltiniroberto on GitHub (May 9, 2025).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6746

There have been cases where I wanted

to whitelist some directory in my home, e.g., ${HOME}/.app1/model
have the rest of the home directory as a temporary filesystem but with exec permissions.

This is because the application that I run, an AppImage, extracts an executable in some other directories in the home (e.g. ${HOME}/.app1/bin), but I do not want these files to persist, and the application needs to execute them.

Describe the solution you'd like

Add a flag or option to allow the temporary filesystem to be mounted without the noexec flag.

Describe alternatives you've considered

With reference to the example above

Use the file transfer functionality to move the executable files extracted from the sandbox into my ${HOME}/.app1/bin directory
whitelist ${HOME}/.app1/bin
make ${HOME}/.app1/bin readonly

Originally created by @saltiniroberto on GitHub (May 9, 2025). Original GitHub issue: https://github.com/netblue30/firejail/issues/6746 ### Is your feature request related to a problem? Please describe. There have been cases where I wanted - to whitelist some directory in my home, e.g., `${HOME}/.app1/model` - have the rest of the home directory as a temporary filesystem but **with exec permissions**. This is because the application that I run, an AppImage, extracts an executable in some other directories in the home (e.g. `${HOME}/.app1/bin`), but I do not want these files to persist, and the application needs to execute them. ### Describe the solution you'd like Add a flag or option to allow the temporary filesystem to be mounted **without** the `noexec` flag. ### Describe alternatives you've considered With reference to the example above - Use the file transfer functionality to move the executable files extracted from the sandbox into my `${HOME}/.app1/bin` directory - whitelist `${HOME}/.app1/bin` - make `${HOME}/.app1/bin` readonly

gitea-mirror added the

enhancement

label 2026-05-05 09:56:16 -06:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3356

No description provided.

Rows
Columns