github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #484] noblacklistfor process child #345

New issue

Closed

opened 2026-05-05 05:38:32 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 05:38:32 -06:00

Owner

Originally created by @liloman on GitHub (Apr 27, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/484

Related to the issue #475.

 noblacklistfor /usr/bin/python3* /usr/bin/youtube-dl

I've been checking the source code briefly and I have noticed how the blacklist mechanism works. (by the way good to have proper comments on the code cause some projects ... :S )

So in order to implement this feature it needs some kind of dynamic approach.
First I'd like to know if it could be developed and then how.

To the later I reckon several options:

Inotify hook on execve to youtube-dl for that profile and unblock python for the child/fork. I'm not sure enough about the inner control for the child.
LD_PRELOAD for the profile with a custom filtered execve so if youtube-dl is executed will unveil the block for python.

Like I said I would like to know if It has a green red first.

Cheers

Originally created by @liloman on GitHub (Apr 27, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/484 Related to the issue #475. ``` noblacklistfor /usr/bin/python3* /usr/bin/youtube-dl ``` I've been checking the source code briefly and I have noticed how the blacklist mechanism works. (by the way good to have proper comments on the code cause some projects ... :S ) So in order to implement this feature it needs some kind of dynamic approach. First I'd like to know if it could be developed and then how. To the later I reckon several options: 1. Inotify hook on execve to youtube-dl for that profile and unblock python for the child/fork. I'm not sure enough about the inner control for the child. 2. LD_PRELOAD for the profile with a custom filtered execve so if youtube-dl is executed will unveil the block for python. Like I said I would like to know if It has a green red first. Cheers

gitea-mirror

2026-05-05 05:38:32 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 05:38:39 -06:00

Author

Owner

@netblue30 commented on GitHub (May 1, 2016):

I looked into it, the problem is inotify message from the kernel is asynchronous. By the time you get the message, the program already started. Actually the message has very low priority, you cannot act on it in real time.

I commented out python blacklists in disable-devel.inc, so this will fix your problem for now. I'll add support for globbing in noblacklist command and put real noblacklists in firefox profile.

@netblue30 commented on GitHub (May 1, 2016): I looked into it, the problem is inotify message from the kernel is asynchronous. By the time you get the message, the program already started. Actually the message has very low priority, you cannot act on it in real time. I commented out python blacklists in disable-devel.inc, so this will fix your problem for now. I'll add support for globbing in noblacklist command and put real noblacklists in firefox profile.

gitea-mirror commented

2026-05-05 05:38:42 -06:00

Author

Owner

@netblue30 commented on GitHub (May 7, 2016):

I'll go with python commented out in disable-devel.inc for the upcoming release. I'll revisit the issue for the release after that.

@netblue30 commented on GitHub (May 7, 2016): I'll go with python commented out in disable-devel.inc for the upcoming release. I'll revisit the issue for the release after that.

gitea-mirror commented

2026-05-05 05:38:45 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (May 7, 2016):

Thanks netblue. 😄

@Fred-Barclay commented on GitHub (May 7, 2016): Thanks netblue. :smile:

gitea-mirror commented

2026-05-05 05:38:48 -06:00

Author

Owner

@liloman commented on GitHub (May 8, 2016):

That's true.

I haven't though in that kind of issue.

Anyway I should better fix actual bugs reported here first than making new features. ;)

@liloman commented on GitHub (May 8, 2016): That's true. I haven't though in that kind of issue. Anyway I should better fix actual bugs reported here first than making new features. ;)

gitea-mirror referenced this issue

2026-05-05 10:04:24 -06:00

[PR #345] [MERGED] More rpm fixes #3600

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#345

No description provided.

Rows
Columns