[PR #1587] [MERGED] Enumerate root directories in apparmor profile #4027

New issue

Closed

opened 2026-05-05 10:12:26 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 10:12:26 -06:00

Owner

📋 Pull Request Information

Original PR: https://github.com/netblue30/firejail/pull/1587
Author: @aerusso
Created: 10/3/2017
Status: ✅ Merged
Merged: 10/4/2017
Merged by: @startx2017

Base: master ← Head: master

📝 Commits (1)

1486219 Enumerate root directories in apparmor profile

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 etc/firejail-default (+1 -1)

📄 Description

Replace opaque character class with an explicit list of root-level directories to be granted access.

The replaced line in the apparmor profile deceptively granted access to all root-level directories that did not start with the letters any of the characters coprsy,^, which is probably not what was intended.

Once apparmor supports the proposed addition, this line can be replaced with {**^sys,proc}, which is what (I am guessing) was intended.

I'm currently running with this rule loaded. Other tools may need more liberal permissions. Notice that this adds access to opt and srv, which previously would not have been whitelisted.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/netblue30/firejail/pull/1587 **Author:** [@aerusso](https://github.com/aerusso) **Created:** 10/3/2017 **Status:** ✅ Merged **Merged:** 10/4/2017 **Merged by:** [@startx2017](https://github.com/startx2017) **Base:** `master` ← **Head:** `master` --- ### 📝 Commits (1) - [`1486219`](https://github.com/netblue30/firejail/commit/14862197711e32aef6768f0c31b7ae071c5ae4e6) Enumerate root directories in apparmor profile ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `etc/firejail-default` (+1 -1) </details> ### 📄 Description Replace opaque character class with an explicit list of root-level directories to be granted access. The replaced line in the apparmor profile deceptively granted access to all root-level directories that did not start with the letters any of the characters `coprsy,^`, which is probably not what was intended. Once apparmor supports the [proposed addition](http://wiki.apparmor.net/index.php/QuickProfileLanguage#Proposed_additions), this line can be replaced with `{**^sys,proc}`, which is what (I am guessing) was intended. I'm currently running with this rule loaded. Other tools may need more liberal permissions. Notice that this **adds** access to `opt` and `srv`, which previously would not have been whitelisted. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

gitea-mirror

2026-05-05 10:12:26 -06:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#4027

No description provided.

Rows
Columns