[GH-ISSUE #608] whitelist and private-dev combination

gitea-mirror commented

2026-05-05 05:50:01 -06:00

Owner

Originally created by @weeshy on GitHub (Jul 2, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/608

I really like idea of clean /dev directory, but I need access to some devices, that is not added by deafult with --private-dev option. I tried to whitelist them, and get empty /dev directory as result.

It would be great, if that options would cooperate with less devastation.

Originally created by @weeshy on GitHub (Jul 2, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/608 I really like idea of clean /dev directory, but I need access to some devices, that is not added by deafult with --private-dev option. I tried to whitelist them, and get empty /dev directory as result. It would be great, if that options would cooperate with less devastation.

gitea-mirror

2026-05-05 05:50:01 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 05:50:09 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Jul 2, 2016):

Can you give an example so we can see what you did?
I suspect that you might need to noblacklist them too but that's just speculation at this point. ;)

@Fred-Barclay commented on GitHub (Jul 2, 2016): Can you give an example so we can see what you did? I suspect that you might need to `noblacklist` them too but that's just speculation at this point. ;)

gitea-mirror commented

2026-05-05 05:50:11 -06:00

Author

Owner

@weeshy commented on GitHub (Jul 2, 2016):

example: I want private /dev, but I need /dev/nvidia0 /dev/nvidiactl /dev/nvidia-modeset for optirun to work correctly.

@weeshy commented on GitHub (Jul 2, 2016): example: I want private /dev, but I need /dev/nvidia0 /dev/nvidiactl /dev/nvidia-modeset for optirun to work correctly.

gitea-mirror commented

2026-05-05 05:50:14 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Jul 2, 2016):

Sorry--what I mean was like firejail --private-dev whitelist=/some/odd/directory or whatever command you used. 😉

@Fred-Barclay commented on GitHub (Jul 2, 2016): Sorry--what I mean was like `firejail --private-dev whitelist=/some/odd/directory` or whatever command you used. :wink:

gitea-mirror commented

2026-05-05 05:50:15 -06:00

Author

Owner

@weeshy commented on GitHub (Jul 2, 2016):

firejail --private-dev --whitelist=/dev/nvidia0

It gives empty /dev/ directory

@weeshy commented on GitHub (Jul 2, 2016): firejail --private-dev --whitelist=/dev/nvidia0 It gives empty /dev/ directory

gitea-mirror commented

2026-05-05 05:50:17 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Jul 3, 2016):

Try this instead:
firejail --whitelist=/dev/nvidia0 --whitelist=/dev/nvidiactl --whitelist=/dev/nvidia-modeset

These three directories will be the only ones visible in /dev/.

After some testing it appears that whitelist and private-dev are mutually exclusive; i.e. whitelist overrides private-dev. I'm not sure why this is (besides the nature of a whitelist being what it is) but I rarely use the private-* options. Maybe someone else with more experience can explain the technical details and/or correct where I'm wrong?

@Fred-Barclay commented on GitHub (Jul 3, 2016): Try this instead: `firejail --whitelist=/dev/nvidia0 --whitelist=/dev/nvidiactl --whitelist=/dev/nvidia-modeset` These three directories will be the only ones visible in /dev/. After some testing it appears that whitelist and private-dev are mutually exclusive; i.e. whitelist overrides private-dev. I'm not sure why this is (besides the nature of a whitelist being what it is) but I rarely use the private-\* options. Maybe someone else with more experience can explain the technical details and/or correct where I'm wrong?

gitea-mirror commented

2026-05-05 05:50:18 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 3, 2016):

The solution is to bring in private-dev all the nvidia devices. So far I have /dev/nvidia[0-9], /dev/nvidiactl, /dev/nvidia-modset and /dev/nvidia-uvm. I'll also bring in /dev/snd for sound. If I am missing something please let me know.

@netblue30 commented on GitHub (Jul 3, 2016): The solution is to bring in private-dev all the nvidia devices. So far I have /dev/nvidia[0-9], /dev/nvidiactl, /dev/nvidia-modset and /dev/nvidia-uvm. I'll also bring in /dev/snd for sound. If I am missing something please let me know.

gitea-mirror commented

2026-05-05 05:50:19 -06:00

Author

Owner

@weeshy commented on GitHub (Jul 3, 2016):

firejail --whitelist works as intented: I just manually specified all devices that are normally is visible under private-dev and add nvidia devices to the list

@weeshy commented on GitHub (Jul 3, 2016): firejail --whitelist works as intented: I just manually specified all devices that are normally is visible under private-dev and add nvidia devices to the list

gitea-mirror commented

2026-05-05 05:50:20 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 3, 2016):

Yes, --whitelist will fix it for now, but I still have to bring in by default nvidia drivers in --private-dev. Anyway, thanks for bringing up this issue.

@netblue30 commented on GitHub (Jul 3, 2016): Yes, --whitelist will fix it for now, but I still have to bring in by default nvidia drivers in --private-dev. Anyway, thanks for bringing up this issue.

gitea-mirror commented

2026-05-05 05:50:23 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 10, 2016):

I put the nvidia/private-dev thing on my todo list for now.

@netblue30 commented on GitHub (Jul 10, 2016): I put the nvidia/private-dev thing on my todo list for now.

gitea-mirror commented

2026-05-05 05:50:25 -06:00

Author

Owner

@nextime commented on GitHub (Aug 1, 2016):

In debian this issue brings some trubbles. As in debian /dev/shm is a symlink to /run/shm, if i use a list of --whitelist to reproduce the behavior of --private-dev i get an error on /dev/shm, and as i need also /dev/shm other than /dev/nvidia*, this seems a stopping issue for me

@nextime commented on GitHub (Aug 1, 2016): In debian this issue brings some trubbles. As in debian /dev/shm is a symlink to /run/shm, if i use a list of --whitelist to reproduce the behavior of --private-dev i get an error on /dev/shm, and as i need also /dev/shm other than /dev/nvidia*, this seems a stopping issue for me

gitea-mirror commented

2026-05-05 05:50:28 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 2, 2016):

Looking into it, thanks.

@netblue30 commented on GitHub (Aug 2, 2016): Looking into it, thanks.

gitea-mirror commented

2026-05-05 05:50:29 -06:00

Author

Owner

@nextime commented on GitHub (Aug 2, 2016):

Just as a work-around in case anyone fall in this issue before a proper fix is found/implemented, i actually use this in /etc/rc.local:

rm /dev/shm
mkdir /dev/shm
mount --bind /run/shm /dev/shm

This way we override the debian/devuan default of having /dev/shm as a synlink by actively remove it and recreate it as a bind mount of /run/shm, and then firejail works with --whitelist /dev/shm as intended.

@nextime commented on GitHub (Aug 2, 2016): Just as a work-around in case anyone fall in this issue before a proper fix is found/implemented, i actually use this in /etc/rc.local: rm /dev/shm mkdir /dev/shm mount --bind /run/shm /dev/shm This way we override the debian/devuan default of having /dev/shm as a synlink by actively remove it and recreate it as a bind mount of /run/shm, and then firejail works with --whitelist /dev/shm as intended.

gitea-mirror commented

2026-05-05 05:50:32 -06:00

Author

Owner

@nextime commented on GitHub (Aug 3, 2016):

UPDATE: same issue ( whitelist a symlink outside the same dir ) in debian and devuan apply also to things in /var/run ( for example, to whitelist /var/run/pcscd to permit use of smartcard authentication ) as /var/run is a symlink to /run

Same workaround as for /dev/shm ( so, remove the symlink and bind mount /run in /var/run in rc.local ) works.

@nextime commented on GitHub (Aug 3, 2016): UPDATE: same issue ( whitelist a symlink outside the same dir ) in debian and devuan apply also to things in /var/run ( for example, to whitelist /var/run/pcscd to permit use of smartcard authentication ) as /var/run is a symlink to /run Same workaround as for /dev/shm ( so, remove the symlink and bind mount /run in /var/run in rc.local ) works.

gitea-mirror commented

2026-05-05 05:50:34 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 16, 2018):

FWIW, we have --keep-dev-shm now, which keeps the original /dev/shm. I don't know if that solves the issue given here though. And yes, --keep-dev-shm is compatible with --private-dev.

@chiraag-nataraj commented on GitHub (Jul 16, 2018): FWIW, we have `--keep-dev-shm` now, which keeps the original `/dev/shm`. I don't know if that solves the issue given here though. And yes, `--keep-dev-shm` is compatible with `--private-dev`.

gitea-mirror commented

2026-05-05 05:50:36 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 30, 2018):

Closed due to inactivity. @nextime feel free to re-open if the workaround listed here doesn't work.

@chiraag-nataraj commented on GitHub (Jul 30, 2018): Closed due to inactivity. @nextime feel free to re-open if the workaround listed here doesn't work.

Rows
Columns

[GH-ISSUE #608] whitelist and private-dev combination #424