[GH-ISSUE #574] Workaround to allow user management with kernels prior to 3.18 when firejail running? #406

New issue

Closed

opened 2026-05-05 05:48:09 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 05:48:09 -06:00

Owner

Originally created by @david-drinn on GitHub (Jun 16, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/574

For those stuck at kernels older than 3.18, is there a workaround to allow user management with adduser (and its various related user management commands) when firejail is running? For my use case, while a user is logged in to firejail in restricted shell mode, the user is allowed to do user management.

I tried these configuration options at the top of /etc/firejail/generic.profile, but it seems to make no difference.

noblacklist /etc/passwd
noblacklist /etc/shadow
noblacklist /etc/group

As a shot in the dark, I also tried disabling chroot and userns in /etc/firejail/firejail.config, with no luck.

I suspect these blacklisted files are tightly integrated with the security of firejail, and so cannot be reasonably whitelisted, but I wanted to ask to be sure. :-)

For reference, this relates to the issue described in the main page's known issues, as well as various issues posted on GitHub, such as 559.

Originally created by @david-drinn on GitHub (Jun 16, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/574 For those stuck at kernels older than 3.18, is there a workaround to allow user management with `adduser` (and its various related user management commands) when firejail is running? For my use case, while a user is logged in to firejail in restricted shell mode, the user is allowed to do user management. I tried these configuration options at the top of `/etc/firejail/generic.profile`, but it seems to make no difference. ``` bash noblacklist /etc/passwd noblacklist /etc/shadow noblacklist /etc/group ``` As a shot in the dark, I also tried disabling `chroot` and `userns` in `/etc/firejail/firejail.config`, with no luck. I suspect these blacklisted files are tightly integrated with the security of firejail, and so cannot be reasonably whitelisted, but I wanted to ask to be sure. :-) For reference, this relates to the issue described in the main page's known issues, as well as various issues posted on GitHub, such as [559](https://github.com/netblue30/firejail/issues/559).

gitea-mirror

2026-05-05 05:48:09 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:48:15 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 17, 2016):

Unfortunately there is no workaround. The fix was deep inside the kernel.

@netblue30 commented on GitHub (Jun 17, 2016): Unfortunately there is no workaround. The fix was deep inside the kernel.

gitea-mirror referenced this issue

2026-05-05 10:04:40 -06:00

[PR #406] [MERGED] add cmus.profile #3612

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#406

No description provided.

Rows
Columns