github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6896] `--profile=FILE` with just a filename has security implications and should be highly discouraged #3407

New issue

Closed

opened 2026-05-05 09:58:14 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 09:58:14 -06:00

Owner

Originally created by @vinc17fr on GitHub (Sep 12, 2025).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6896

Description

Most examples in the firejail(1) man page suggest to use --profile with just a filename (profile name), without a colon. However, if the filename happens to exist in the current directory, it will be chosen as the security profile instead of the usual one found in standard paths; this is most often unexpected. Such a use should be highly discouraged (and in particular, no longer given as examples). As a general rule, reading config files in the current directory is a bad idea, in particular when there are security implications like here. This is almost as bad as having . first in $PATH.

IMHO, since this is error prone, a search in the current directory should even be disabled, except when explicitly requested with --profile=./FILE. So the use of the colon (:) would become unnecessary.

Steps to Reproduce

$ touch firefox
$ firejail --profile=firefox sh
firejail version 0.9.76

Parent pid 2086515, child pid 2086516
[...]

So this has the effect to start firejail with an empty profile, which is usually unexpected. If the file has arbitrary contents, this will make firejail immediately exit with an error.

Note: This happened to me because in one of my directories, there was a file named firefox. As this happened via a script, it took me time to find the cause of the silent failure (for some reason, the error message could not be visible, so I first blamed less, then xterm (which ran the command), then Firefox, before eventually finding that the cause was firejail).

Checklist

I have performed a short search for similar issues (to avoid opening a duplicate).
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Even the checklist is misleading: --profile=PROFILENAME is what triggers the issue!

Originally created by @vinc17fr on GitHub (Sep 12, 2025). Original GitHub issue: https://github.com/netblue30/firejail/issues/6896 ### Description Most examples in the firejail(1) man page suggest to use `--profile` with just a filename (profile name), without a colon. However, if the filename happens to exist in the current directory, it will be chosen as the security profile instead of the usual one found in standard paths; this is most often unexpected. Such a use should be highly discouraged (and in particular, no longer given as examples). As a general rule, reading config files in the current directory is a bad idea, in particular when there are security implications like here. This is almost as bad as having `.` first in `$PATH`. IMHO, since this is error prone, a search in the current directory should even be disabled, except when explicitly requested with `--profile=./FILE`. So the use of the colon (`:`) would become unnecessary. ### Steps to Reproduce ``` $ touch firefox $ firejail --profile=firefox sh firejail version 0.9.76 Parent pid 2086515, child pid 2086516 [...] ``` So this has the effect to start firejail with an empty profile, which is usually unexpected. If the file has arbitrary contents, this will make firejail immediately exit with an error. Note: This happened to me because in one of my directories, there was a file named `firefox`. As this happened via a script, it took me time to find the cause of the silent failure (for some reason, the error message could not be visible, so I first blamed `less`, then xterm (which ran the command), then Firefox, before eventually finding that the cause was firejail). ### Checklist - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) Even the checklist is misleading: `--profile=PROFILENAME` is what triggers the issue!

gitea-mirror

2026-05-05 09:58:14 -06:00

closed this issue
added the
enhancement

security
labels

gitea-mirror commented

2026-05-05 09:58:17 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 13, 2025):

Somewhat related: #3798

@rusty-snake commented on GitHub (Sep 13, 2025): Somewhat related: #3798

gitea-mirror commented

2026-05-05 09:58:17 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 9, 2026):

Fixed, thanks @vinc17fr

@netblue30 commented on GitHub (Jan 9, 2026): Fixed, thanks @vinc17fr

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3407

No description provided.

Rows
Columns

[GH-ISSUE #6896] --profile=FILE with just a filename has security implications and should be highly discouraged #3407

Description

Steps to Reproduce

Checklist

[GH-ISSUE #6896] `--profile=FILE` with just a filename has security implications and should be highly discouraged #3407