[GH-ISSUE #588] support home directory outside of /home #412

New issue

Closed

opened 2026-05-05 05:49:04 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 05:49:04 -06:00

Owner

Originally created by @4nd3r on GitHub (Jun 20, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/588

It would simplify firejailing system daemons, because many have homes under /var/lib/ etc.

copy and modify packaged init file
create firejail profile
???
PROFIT

related #530

Originally created by @4nd3r on GitHub (Jun 20, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/588 It would simplify firejailing system daemons, because many have homes under `/var/lib/` etc. - copy and modify packaged init file - create firejail profile - ??? - PROFIT related #530

gitea-mirror

2026-05-05 05:49:04 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:49:09 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 21, 2016):

The complexity of implementing user home outside /home directory is huge. I am not prepered to go there yet.

Servers are taken care of, regular home directories are empty:

$ sudo firejail 
Reading profile /etc/firejail/server.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-passwdmgr.inc

** Note: you can use --noprofile to disable server.profile **

Parent pid 11819, child pid 11820
The new log directory is /proc/11820/root/var/log

Child process initialized
$ ls -l /root/
total 0
$ ls -l /home
total 0
$

@netblue30 commented on GitHub (Jun 21, 2016): The complexity of implementing user home outside /home directory is huge. I am not prepered to go there yet. Servers are taken care of, regular home directories are empty: ``` $ sudo firejail Reading profile /etc/firejail/server.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-passwdmgr.inc ** Note: you can use --noprofile to disable server.profile ** Parent pid 11819, child pid 11820 The new log directory is /proc/11820/root/var/log Child process initialized $ ls -l /root/ total 0 $ ls -l /home total 0 $ ```

gitea-mirror commented

2026-05-05 05:49:11 -06:00

Author

Owner

@4nd3r commented on GitHub (Jun 21, 2016):

Okay, so, I was looking at transmission-daemon packaged in Debian. By default it runs as separate debian-transmission user and home directory is in /var/lib/transmission-daemon/. As we know, to better seed different ISO files, it's good to have working port forwarding. But open port to machine is slippery road if someone discovers exploitable bug in transmission-daemon, lets add local privilege escalation and voila. Yeah, I know, it's a long shot and quite expensive attack vector to use, but still.

Maybe I'm lazy, but without much hassle you could throw in wonderful firejail (just create firejail profile, disable packaged service file and create new) and be done with it. But of course one can always change debian-transmission home path or run firejail transmission-daemon as your own user instead and not use separate user.

But thanks for your effort! I'm very pleased with firejail, but discovered this little annoyance yesterday and wondered how hard could it be!? Oh boy, was I wrong! If you say that it's complex then I can live with that :-) Cheers!

@4nd3r commented on GitHub (Jun 21, 2016): Okay, so, I was looking at transmission-daemon packaged in Debian. By default it runs as separate `debian-transmission` user and home directory is in `/var/lib/transmission-daemon/`. As we know, to better seed different ISO files, it's good to have working port forwarding. But open port to machine is slippery road if someone discovers exploitable bug in transmission-daemon, lets add local privilege escalation and voila. Yeah, I know, it's a long shot and quite expensive attack vector to use, but still. Maybe I'm lazy, but without much hassle you could throw in wonderful firejail (just create firejail profile, disable packaged service file and create new) and be done with it. But of course one can always change `debian-transmission` home path or run `firejail transmission-daemon` as your own user instead and not use separate user. But thanks for your effort! I'm very pleased with firejail, but discovered this little annoyance yesterday and wondered how hard could it be!? Oh boy, was I wrong! If you say that it's complex then I can live with that :-) Cheers!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#412

No description provided.

Rows
Columns