github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #7118] telegram: cannot access custom whitelisted path #3491

New issue

Open

opened 2026-05-05 10:01:49 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 10:01:49 -06:00

Owner

Originally created by @sapphirepro on GitHub (Mar 29, 2026).
Original GitHub issue: https://github.com/netblue30/firejail/issues/7118

Description

Tool almost useless, as it doesn't allow blocking storage while keeping spefic path available.

Config part like:

blacklist /Arhiv/*
noblacklist /Arhiv/Clouds?Sync
noblacklist /Arhiv/Clouds?Sync/NextCloud
whitelist /Arhiv/Clouds?Sync
whitelist /Arhiv/Clouds?Sync/NextCloud
doesn't work

Steps to Reproduce

Steps to reproduce the behavior
described above. Must page nothing visible expect nested specific folder.

Expected behavior

To make invisible contents of /Arhiv/, but visible all inside /Arhiv/Cloud Sync/NextCloud/

Actual behavior

Cloud Sync folder was access denied, which is a bug.

Behavior without a profile

What changed calling LC_ALL=C firejail --noprofile /path/to/program in a
terminal?

Additional context

Any other detail that may help to understand/debug the problem

Environment

Operating System: openSUSE Tumbleweed 20260326
KDE Plasma Version: 6.6.3
KDE Frameworks Version: 6.24.0
Qt Version: 6.10.2
Kernel Version: 6.19.10-3.g5a8a0a5-default (64-bit)
Graphics Platform: Wayland
Processors: 16 × Intel® Xeon® W-10885M CPU @ 2.40GHz
Memory: 128 GiB of RAM (125.5 GiB usable)
Graphics Processor: Quadro RTX 5000
Manufacturer: Dell Inc.
Product Name: Precision 7750

Checklist

[x ] I am using firejail 0.9.80 or later
[ x] I am using the full program path (e.g. firejail /usr/bin/vlc instead of firejail vlc; see https://github.com/netblue30/firejail/issues/2877)
[ x] The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail /path/to/program

output goes here

Output of LC_ALL=C firejail --debug /path/to/program

output goes here

Originally created by @sapphirepro on GitHub (Mar 29, 2026). Original GitHub issue: https://github.com/netblue30/firejail/issues/7118  ### Description Tool almost useless, as it doesn't allow blocking storage while keeping spefic path available. Config part like: blacklist /Arhiv/* noblacklist /Arhiv/Clouds?Sync noblacklist /Arhiv/Clouds?Sync/NextCloud whitelist /Arhiv/Clouds?Sync whitelist /Arhiv/Clouds?Sync/NextCloud doesn't work ### Steps to Reproduce _Steps to reproduce the behavior_ described above. Must page nothing visible expect nested specific folder. ### Expected behavior To make invisible contents of /Arhiv/, but visible all inside /Arhiv/Cloud Sync/NextCloud/ ### Actual behavior Cloud Sync folder was access denied, which is a bug. ### Behavior without a profile _What changed calling `LC_ALL=C firejail --noprofile /path/to/program` in a terminal?_ ### Additional context _Any other detail that may help to understand/debug the problem_ ### Environment Operating System: openSUSE Tumbleweed 20260326 KDE Plasma Version: 6.6.3 KDE Frameworks Version: 6.24.0 Qt Version: 6.10.2 Kernel Version: 6.19.10-3.g5a8a0a5-default (64-bit) Graphics Platform: Wayland Processors: 16 × Intel® Xeon® W-10885M CPU @ 2.40GHz Memory: 128 GiB of RAM (125.5 GiB usable) Graphics Processor: Quadro RTX 5000 Manufacturer: Dell Inc. Product Name: Precision 7750 ### Checklist  - [x ] I am using firejail [0.9.80 or later](https://github.com/netblue30/firejail/tree/master/SECURITY.md) - [ x] I am using the full program path (e.g. `firejail /usr/bin/vlc` instead of `firejail vlc`; see `https://github.com/netblue30/firejail/issues/2877`) - [ x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [ ] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [ ] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [ ] I have performed a short search for similar issues (to avoid opening a duplicate). - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <details> <summary>Output of <code>LC_ALL=C firejail /path/to/program</code></summary> <p> ``` output goes here ``` </p> </details> <details> <summary>Output of <code>LC_ALL=C firejail --debug /path/to/program</code></summary> <p>  ``` output goes here ``` </p> </details>

gitea-mirror commented

2026-05-05 10:01:51 -06:00

Author

Owner

@sapphirepro commented on GitHub (Mar 29, 2026):

Was used custom profile in ~/.config/firejail/ as I need custom profile for telegram (not rpm, but official website downloadable binary. Not modifying profile in /etc/firejail/ since it will be overwritten on firejail update.

In general, software totally useless if it can not hide all except nested desired paths.

Another problem is, program doesn't handle normally lmt sub executable. Long ago firejail supported cpu and ram limits, then it was kicked off. So extra layer from another app needed that limits cpu and ram (Telegram often had memory leaks issues, that caused whole system crash).

Normally without firefail executable would be like this:

[Desktop Entry]
Comment[en_US]=
Comment=
Exec=~/go/bin/lmt run -c 30 -n 4 -m 2000 /Arhiv/Telegram/Telegram
GenericName[en_US]=
GenericName=
Icon=org.telegram.desktop
MimeType=
Name[en_US]=Telegram
Name=Telegram
Path=
StartupNotify=true
Terminal=false
TerminalOptions=
Type=Application
X-KDE-SubstituteUID=false
X-KDE-Username=

@sapphirepro commented on GitHub (Mar 29, 2026): Was used custom profile in ~/.config/firejail/ as I need custom profile for telegram (not rpm, but official website downloadable binary. Not modifying profile in /etc/firejail/ since it will be overwritten on firejail update. In general, software totally useless if it can not hide all except nested desired paths. Another problem is, program doesn't handle normally lmt sub executable. Long ago firejail supported cpu and ram limits, then it was kicked off. So extra layer from another app needed that limits cpu and ram (Telegram often had memory leaks issues, that caused whole system crash). Normally without firefail executable would be like this: [Desktop Entry] Comment[en_US]= Comment= Exec=~/go/bin/lmt run -c 30 -n 4 -m 2000 /Arhiv/Telegram/Telegram GenericName[en_US]= GenericName= Icon=org.telegram.desktop MimeType= Name[en_US]=Telegram Name=Telegram Path= StartupNotify=true Terminal=false TerminalOptions= Type=Application X-KDE-SubstituteUID=false X-KDE-Username=

gitea-mirror commented

2026-05-05 10:01:51 -06:00

Author

Owner

@OndrejMalek commented on GitHub (Apr 15, 2026):

@sapphirepro
TLDR first whitelist than blacklist inside whitelisted dirs

You should just use smt like: (are u sure that Arhiv should be in root dir? needs absolute paths)

whitelist /Arhiv/Clouds?Sync/NextCloud

see https://www.perplexity.ai/search/firejail-how-whitelist-blackli-xZkd5HIiRCCCWMsBhkOXAQ

IMHO this is issue of Firejail documentation and how whitelist/blacklist/noblacklist/private work together. I also struggled with that everytime I went back to Firejail.

@OndrejMalek commented on GitHub (Apr 15, 2026): @sapphirepro TLDR first whitelist than blacklist inside whitelisted dirs You should just use smt like: (are u sure that Arhiv should be in root dir? needs absolute paths) ``` whitelist /Arhiv/Clouds?Sync/NextCloud ``` see https://www.perplexity.ai/search/firejail-how-whitelist-blackli-xZkd5HIiRCCCWMsBhkOXAQ IMHO this is issue of Firejail documentation and how whitelist/blacklist/noblacklist/private work together. I also struggled with that everytime I went back to Firejail.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3491

No description provided.

Rows
Columns