[GH-ISSUE #583] How to hide entire home directory except number of subdirectories #409

New issue

Closed

opened 2026-05-05 05:48:39 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 05:48:39 -06:00

Owner

Originally created by @weeshy on GitHub (Jun 19, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/583

I'd like to hide from an application entire ${HOME} directory, but allow access to number of working directories, that lies inside the home, like ${HOME}/MyWorkDir and ${HOME}/MyCacheDir.

I've tried --private with --whitelist, but whitelist was ignored, I've got an empty home directory. I give another try to --blacklist=${HOME} and --whitelist=${HOME}/MyWorkDir, but whitelist was ignored again: I could not access specified directory that is inside a blacklisted path.

So, how it is supposed to configure firejail in that use case? Some of directories should be whitelisted as read-only weights a lot, so I could just copy them to another directory and go the way of full chroot.

Originally created by @weeshy on GitHub (Jun 19, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/583 I'd like to hide from an application entire ${HOME} directory, but allow access to number of working directories, that lies inside the home, like ${HOME}/MyWorkDir and ${HOME}/MyCacheDir. I've tried --private with --whitelist, but whitelist was ignored, I've got an empty home directory. I give another try to --blacklist=${HOME} and --whitelist=${HOME}/MyWorkDir, but whitelist was ignored again: I could not access specified directory that is inside a blacklisted path. So, how it is supposed to configure firejail in that use case? Some of directories should be whitelisted as read-only weights a lot, so I could just copy them to another directory and go the way of full chroot.

gitea-mirror

2026-05-05 05:48:39 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:48:46 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 19, 2016):

--whitelist does all the job by default. You don't need to add --blacklist or --private:

$ firejail --whitelist=~/work --whitelist=~/bin
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-passwdmgr.inc

** Note: you can use --noprofile to disable default.profile **

Parent pid 26261, child pid 26262

Child process initialized
$ ls -l
total 8
drwxr-xr-x  7 netblue netblue 4096 Apr  6 22:06 bin
drwxr-xr-x 20 netblue netblue 4096 Jun  9 21:57 work
$

@netblue30 commented on GitHub (Jun 19, 2016): --whitelist does all the job by default. You don't need to add --blacklist or --private: ``` $ firejail --whitelist=~/work --whitelist=~/bin Reading profile /etc/firejail/default.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-passwdmgr.inc ** Note: you can use --noprofile to disable default.profile ** Parent pid 26261, child pid 26262 Child process initialized $ ls -l total 8 drwxr-xr-x 7 netblue netblue 4096 Apr 6 22:06 bin drwxr-xr-x 20 netblue netblue 4096 Jun 9 21:57 work $ ```

gitea-mirror commented

2026-05-05 05:48:49 -06:00

Author

Owner

@weeshy commented on GitHub (Jun 19, 2016):

That works fine, thanks for the information

@weeshy commented on GitHub (Jun 19, 2016): That works fine, thanks for the information

gitea-mirror referenced this issue

2026-05-05 10:04:41 -06:00

[PR #409] [MERGED] Allow alternative opera config path #3614

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#409

No description provided.

Rows
Columns