github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6939] Unable to blacklist file with \ character in filename #3427

New issue

Open

opened 2026-05-05 09:59:40 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:59:40 -06:00

Owner

Originally created by @CCF100 on GitHub (Oct 15, 2025).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6939

Description

I'm trying to blacklist a udev device to prevent a program from accessing a specific controller, however, it won't let me blacklist the controller because its device file path contains a "\" character

Steps to Reproduce

Create a script with someting similar to this:

#!/bin/bash
set -x
firejail \
  --blacklist=$(readlink -f '/run/udev/links/input\x2fby-id\x2fusb-Valve_Software_Steam_Controller_123456789ABCDEF-'*) \
  --blacklist=$(readlink -f /dev/input/by-path/pci-0000:04:00.4-usbv2-0:3:1.1-event-kbd) \
  --blacklist=$(readlink -f /dev/input/by-path/pci-0000:04:00.4-usb-0:3:1.2-event-joystick) \
  --blacklist=$(readlink -f /dev/input/by-path/pci-0000:04:00.4-usbv2-0:3:1.0-event-mouse) \
  --noprofile "$@"

Firejail returns:

Error: "/run/udev/links/input\x2fby-id\x2fusb-Valve_Software_Steam_Controller_123456789ABCDEF-event-mouse" is an invalid filename: rejected character: "\"

Originally created by @CCF100 on GitHub (Oct 15, 2025). Original GitHub issue: https://github.com/netblue30/firejail/issues/6939  ### Description I'm trying to blacklist a udev device to prevent a program from accessing a specific controller, however, it won't let me blacklist the controller because its device file path contains a "\\" character ### Steps to Reproduce 1. Create a script with someting similar to this: ``` #!/bin/bash set -x firejail \ --blacklist=$(readlink -f '/run/udev/links/input\x2fby-id\x2fusb-Valve_Software_Steam_Controller_123456789ABCDEF-'*) \ --blacklist=$(readlink -f /dev/input/by-path/pci-0000:04:00.4-usbv2-0:3:1.1-event-kbd) \ --blacklist=$(readlink -f /dev/input/by-path/pci-0000:04:00.4-usb-0:3:1.2-event-joystick) \ --blacklist=$(readlink -f /dev/input/by-path/pci-0000:04:00.4-usbv2-0:3:1.0-event-mouse) \ --noprofile "$@" ``` 2. Firejail returns: ``` Error: "/run/udev/links/input\x2fby-id\x2fusb-Valve_Software_Steam_Controller_123456789ABCDEF-event-mouse" is an invalid filename: rejected character: "\" ```

gitea-mirror added the

needinfo

label 2026-05-05 09:59:40 -06:00

gitea-mirror commented

2026-05-05 09:59:42 -06:00

Author

Owner

@CCF100 commented on GitHub (Oct 15, 2025):

Update: I tried allowing "\" by editing the source code, but now it returns "permission denied" when I try to execute anything with those paths blacklisted...

Here's the patch:

From 2d3a57bba428d53214de47d26f00fd004e9d7f52 Mon Sep 17 00:00:00 2001
From: Chloe Christine Fontenot <foley2431@gmail.com>
Date: Wed, 15 Oct 2025 16:14:47 -0500
Subject: [PATCH] Allow backslash as valid character

---
 src/lib/common.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/lib/common.c b/src/lib/common.c
index 51a19e895..81dd1aeef 100644
--- a/src/lib/common.c
+++ b/src/lib/common.c
@@ -489,9 +489,9 @@ void reject_meta_chars(const char *fname, int globbing) {
 
        reject_cntrl_chars(fname);
 
-       const char *reject = "\\&!?\"<>%^{};,*[]";
+       const char *reject = "&!?\"<>%^{};,*[]";
        if (globbing)
-               reject = "\\&!\"<>%^{};,"; // file globbing ('*?[]') is allowed
+               reject = "&!\"<>%^{};,"; // file globbing ('*?[]') is allowed
 
        const char *c = strpbrk(fname, reject);
        if (c) {
-- 
2.51.0

@CCF100 commented on GitHub (Oct 15, 2025): Update: I tried allowing "\\" by editing the source code, but now it returns "permission denied" when I try to execute *anything* with those paths blacklisted... Here's the patch: ``` From 2d3a57bba428d53214de47d26f00fd004e9d7f52 Mon Sep 17 00:00:00 2001 From: Chloe Christine Fontenot <foley2431@gmail.com> Date: Wed, 15 Oct 2025 16:14:47 -0500 Subject: [PATCH] Allow backslash as valid character --- src/lib/common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/lib/common.c b/src/lib/common.c index 51a19e895..81dd1aeef 100644 --- a/src/lib/common.c +++ b/src/lib/common.c @@ -489,9 +489,9 @@ void reject_meta_chars(const char *fname, int globbing) { reject_cntrl_chars(fname); - const char *reject = "\\&!?\"<>%^{};,*[]"; + const char *reject = "&!?\"<>%^{};,*[]"; if (globbing) - reject = "\\&!\"<>%^{};,"; // file globbing ('*?[]') is allowed + reject = "&!\"<>%^{};,"; // file globbing ('*?[]') is allowed const char *c = strpbrk(fname, reject); if (c) { -- 2.51.0 ```

gitea-mirror commented

2026-05-05 09:59:43 -06:00

Author

Owner

@kmk3 commented on GitHub (Oct 24, 2025):

Basic debugging information is missing; please follow the bug report template:

https://github.com/netblue30/firejail/issues/new?template=bug_report.md

@kmk3 commented on GitHub (Oct 24, 2025): Basic debugging information is missing; please follow the bug report template: * <https://github.com/netblue30/firejail/issues/new?template=bug_report.md>

gitea-mirror commented

2026-05-05 09:59:44 -06:00

Author

Owner

@kmk3 commented on GitHub (Oct 24, 2025):

Create a script with someting similar to this:

#!/bin/bash
set -x
firejail \
  --blacklist=$(readlink -f '/run/udev/links/input\x2fby-id\x2fusb-Valve_Software_Steam_Controller_123456789ABCDEF-'*) \
  --blacklist=$(readlink -f /dev/input/by-path/pci-0000:04:00.4-usbv2-0:3:1.1-event-kbd) \
  --blacklist=$(readlink -f /dev/input/by-path/pci-0000:04:00.4-usb-0:3:1.2-event-joystick) \
  --blacklist=$(readlink -f /dev/input/by-path/pci-0000:04:00.4-usbv2-0:3:1.0-event-mouse) \
  --noprofile "$@"

Firejail returns:

Error: "/run/udev/links/input\x2fby-id\x2fusb-Valve_Software_Steam_Controller_123456789ABCDEF-event-mouse" is an invalid filename: rejected character: "\"

Why use that /run/udev/links/... path instead of just /dev/input/by-id/...?

@kmk3 commented on GitHub (Oct 24, 2025): > 1. Create a script with someting similar to this: > > > ``` > #!/bin/bash > set -x > firejail \ > --blacklist=$(readlink -f '/run/udev/links/input\x2fby-id\x2fusb-Valve_Software_Steam_Controller_123456789ABCDEF-'*) \ > --blacklist=$(readlink -f /dev/input/by-path/pci-0000:04:00.4-usbv2-0:3:1.1-event-kbd) \ > --blacklist=$(readlink -f /dev/input/by-path/pci-0000:04:00.4-usb-0:3:1.2-event-joystick) \ > --blacklist=$(readlink -f /dev/input/by-path/pci-0000:04:00.4-usbv2-0:3:1.0-event-mouse) \ > --noprofile "$@" > ``` > > 2. Firejail returns: > > > ``` > Error: "/run/udev/links/input\x2fby-id\x2fusb-Valve_Software_Steam_Controller_123456789ABCDEF-event-mouse" is an invalid filename: rejected character: "\" > ``` Why use that `/run/udev/links/...` path instead of just `/dev/input/by-id/...`?

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3427

No description provided.

Rows
Columns