github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #511] Permit disabling/whitelisting features system-wide #363

New issue

Closed

opened 2026-05-05 05:41:30 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 05:41:30 -06:00

Owner

Originally created by @KellerFuchs on GitHub (May 12, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/511

Currently, it is problematic for an administrator to install firejail in a multiuser environment, as there is no way to prevent users from using problematic features (which aren't problematic on a local, single-user computer, usually).

For instance:

interface, ip, ip6 and iprange all allow the user to configure network interfaces;
net lets a user “grab” a new IP on the local network: in some circumstances (network using routable addresses, colocation, ...), this is highly undesirable [0].

The simplest way I can see to handle that is to let the sysadmin specify either a whitelist or a blacklist of features in a dedicated file under /etc/firejail. Special care must be taken to avoid features such as private-etc being used to fool firejail into ignoring those restrictions.

[0] Some providers have trigger-happy automation that would consider it an IP-spoofing attempt and it would lead to the server being immediately shut down.

Originally created by @KellerFuchs on GitHub (May 12, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/511 Currently, it is problematic for an administrator to install `firejail` in a multiuser environment, as there is no way to prevent users from using problematic features (which aren't problematic on a local, single-user computer, usually). For instance: - `interface`, `ip`, `ip6` and `iprange` all allow the user to configure network interfaces; - `net` lets a user “grab” a new IP on the local network: in some circumstances (network using routable addresses, colocation, ...), this is highly undesirable [0]. The simplest way I can see to handle that is to let the sysadmin specify either a whitelist or a blacklist of features in a dedicated file under `/etc/firejail`. Special care must be taken to avoid features such as `private-etc` being used to fool `firejail` into ignoring those restrictions. [0] Some providers have trigger-happy automation that would consider it an IP-spoofing attempt and it would lead to the server being immediately shut down.

gitea-mirror

2026-05-05 05:41:30 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:41:37 -06:00

Author

Owner

@netblue30 commented on GitHub (May 12, 2016):

I'll have a new firejail version out in a few days. For now you can grab the code from git. The new version fixes this problem by using a run-time configuration file: /etc/firejail/firejail.config. Among other things, it allows the admin to disable networking. This is the link in git: https://github.com/netblue30/firejail/blob/master/etc/firejail.config

@netblue30 commented on GitHub (May 12, 2016): I'll have a new firejail version out in a few days. For now you can grab the code from git. The new version fixes this problem by using a run-time configuration file: /etc/firejail/firejail.config. Among other things, it allows the admin to disable networking. This is the link in git: https://github.com/netblue30/firejail/blob/master/etc/firejail.config

gitea-mirror commented

2026-05-05 05:41:39 -06:00

Author

Owner

@KellerFuchs commented on GitHub (May 13, 2016):

@netblue30 I indeed didn't notice this was already possible in the current git version.

Sorry for the spurious issue.

@KellerFuchs commented on GitHub (May 13, 2016): @netblue30 I indeed didn't notice this was already possible in the current git version. Sorry for the spurious issue.

gitea-mirror commented

2026-05-05 05:41:42 -06:00

Author

Owner

@netblue30 commented on GitHub (May 13, 2016):

No problem! If you need something else to be disabled, I can add support easily.

@netblue30 commented on GitHub (May 13, 2016): No problem! If you need something else to be disabled, I can add support easily.

gitea-mirror commented

2026-05-05 05:41:43 -06:00

Author

Owner

@KellerFuchs commented on GitHub (May 13, 2016):

Thanks a lot.

I will reopen the issue if I find features that are problematic and that you don't (yet) support blocking.

@KellerFuchs commented on GitHub (May 13, 2016): Thanks a lot. I will reopen the issue if I find features that are problematic and that you don't (yet) support blocking.

gitea-mirror referenced this issue

2026-05-05 10:04:29 -06:00

[PR #363] [MERGED] Forward exit code from child process #3602

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#363

No description provided.

Rows
Columns