github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #7047] Be able to choose uid/gid inside sandbox #3465

New issue

Open

opened 2026-05-05 10:00:50 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 10:00:50 -06:00

Owner

Originally created by @liloman on GitHub (Jan 29, 2026).
Original GitHub issue: https://github.com/netblue30/firejail/issues/7047

I would like to be able to change the user inside the sandbox. AFAIK the uid/gid are set by the user executing firejail with getuid/getgid in order to do the mapping inside the user namespace

Describe the solution you'd like

I would like to be able to execute:

firejail --uid=1004 --gid=1004 sh -c 'id'

Describe alternatives you've considered

I created 1004 beforehand.

# unshare -p --fork --mount-proc --setuid 1004 --setgid 1004 sh -c 'id'
uid=1004(dev) gid=1004(dev) groups=1004(dev)

Or with bwrap:

$ bwrap \
  --ro-bind /etc/resolv.conf /etc/resolv.conf \
  --ro-bind /usr /usr \
  --ro-bind /bin /bin \
  --ro-bind /lib /lib \
  --ro-bind /lib64 /lib64 \
  --proc /proc \
  --dev /dev \
  --tmpfs /tmp \
  --unshare-all \
  --share-net \
  --uid 1004   \
  --gid 1004   \
  --as-pid-1 \
  --die-with-parent \
  /bin/bash

$ id
uid=1004 gid=1004 groups=1004,65534

Environment

Version of Firejail (firejail --version):

firejail version 0.9.78

Originally created by @liloman on GitHub (Jan 29, 2026). Original GitHub issue: https://github.com/netblue30/firejail/issues/7047 ### Is your feature request related to a problem? Please describe. I would like to be able to change the user inside the sandbox. AFAIK the uid/gid are set by the user executing firejail with getuid/getgid in order to do the mapping inside the user namespace ### Describe the solution you'd like I would like to be able to execute: ```sh firejail --uid=1004 --gid=1004 sh -c 'id' ``` ### Describe alternatives you've considered I created 1004 beforehand. ```console # unshare -p --fork --mount-proc --setuid 1004 --setgid 1004 sh -c 'id' uid=1004(dev) gid=1004(dev) groups=1004(dev) ``` Or with bwrap: ```console $ bwrap \ --ro-bind /etc/resolv.conf /etc/resolv.conf \ --ro-bind /usr /usr \ --ro-bind /bin /bin \ --ro-bind /lib /lib \ --ro-bind /lib64 /lib64 \ --proc /proc \ --dev /dev \ --tmpfs /tmp \ --unshare-all \ --share-net \ --uid 1004 \ --gid 1004 \ --as-pid-1 \ --die-with-parent \ /bin/bash ``` ```console $ id uid=1004 gid=1004 groups=1004,65534 ``` ### Environment - Version of Firejail (`firejail --version`): firejail version 0.9.78

gitea-mirror added the

enhancement

label 2026-05-05 10:00:50 -06:00

gitea-mirror commented

2026-05-05 10:00:52 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 29, 2026):

We'll do!

@netblue30 commented on GitHub (Jan 29, 2026): We'll do!

gitea-mirror commented

2026-05-05 10:00:53 -06:00

Author

Owner

@liloman commented on GitHub (Jan 29, 2026):

In order to be user friendly maybe we should consider extras steps like:

firejail --as-user=dev

And it checks for the user, gets uid/gid and sets the minimal stuff like $HOME, $USER and $PATH

It could be nice ... :\

@liloman commented on GitHub (Jan 29, 2026): In order to be user friendly maybe we should consider extras steps like: firejail --as-user=dev And it checks for the user, gets uid/gid and sets the minimal stuff like $HOME, $USER and $PATH It could be nice ... :\

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3465

No description provided.

Rows
Columns