github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #699] Modifying firefox install dir inside jail but not outside #477

New issue

Closed

opened 2026-05-05 05:56:03 -06:00 by gitea-mirror · 7 comments

gitea-mirror commented

2026-05-05 05:56:03 -06:00

Owner

Originally created by @unixpipecentipede on GitHub (Aug 11, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/699

Is it possible to create/copy new files into a jail filesystem?

For example, a firefox-esr instance running in a jail with 2 new files in the installation directory:

/usr/lib/firefox-esr/defaults/pref/local-settings.js
/usr/lib/firefox-esr/mozilla.cfg

In the jail firefox acknowledges the files. In the original filesystem everything remains intact, thus not altering the original firefox-esr installation directory upon closing the jail.

I'm not familiar with the subject but in proper terms the original installation dir should be copied into the jail along with the new files (not mounted) before running firefox?

Originally created by @unixpipecentipede on GitHub (Aug 11, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/699 Is it possible to create/copy new files into a jail filesystem? For example, a `firefox-esr` instance running in a jail with 2 new files in the installation directory: ``` /usr/lib/firefox-esr/defaults/pref/local-settings.js /usr/lib/firefox-esr/mozilla.cfg ``` In the jail firefox acknowledges the files. In the original filesystem everything remains intact, thus not altering the original `firefox-esr` installation directory upon closing the jail. I'm not familiar with the subject but in proper terms the original installation dir should be copied into the jail along with the new files (not mounted) before running firefox?

gitea-mirror

2026-05-05 05:56:03 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 05:56:12 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 12, 2016):

The easiest way would be to set up a wrapper script that ends up calling firefox but sets up the environment first.

@chiraag-nataraj commented on GitHub (Aug 12, 2016): The easiest way would be to set up a wrapper script that ends up calling firefox but sets up the environment first.

gitea-mirror commented

2026-05-05 05:56:15 -06:00

Author

Owner

@unixpipecentipede commented on GitHub (Aug 12, 2016):

@chiraag-nataraj i.e. calling the wrapper script through firejail?

The wrapper doing:

Copy local-settings.js to /usr/lib/firefox-esr/defaults/pref
Copy mozilla.cfg to /usr/lib/firefox-esr
Run firefox-esr

These actions shouldn't change the base filesystem, right?

@unixpipecentipede commented on GitHub (Aug 12, 2016): @chiraag-nataraj i.e. calling the wrapper script through firejail? The wrapper doing: 1. Copy local-settings.js to /usr/lib/firefox-esr/defaults/pref 2. Copy mozilla.cfg to /usr/lib/firefox-esr 3. Run firefox-esr These actions shouldn't change the base filesystem, right?

gitea-mirror commented

2026-05-05 05:56:17 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 12, 2016):

Hmmm....so I guess the only way that would work is if you do a overlay-tmpfs on top of /usr/lib/firefox-esr. Actually, that might be the easier way (without scripts) - do an overlay-tmpfs between the original /usr/lib/firefox-esr and the directory containing mozilla.cfg and between the original /usr/lib/firefox-esr/defaults/prefs and the directory containing local-settings.js

@chiraag-nataraj commented on GitHub (Aug 12, 2016): Hmmm....so I guess the only way that would work is if you do a overlay-tmpfs on top of /usr/lib/firefox-esr. Actually, that might be the easier way (without scripts) - do an overlay-tmpfs between the original /usr/lib/firefox-esr and the directory containing mozilla.cfg and between the original /usr/lib/firefox-esr/defaults/prefs and the directory containing local-settings.js

gitea-mirror commented

2026-05-05 05:56:19 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 13, 2016):

I've found out this description about "Locking preferences" on Mozilla site: http://kb.mozillazine.org/Locking_preferences

We are gonna have to support it, but for now you can use --bind. Unfortunately, --bind is available only if you start as root, something like this:

$ su
# firejail --noprofile --bind=/path/mozilla.cfg,/usr/lib/firefox-esr/mozilla.cfg --bind=/path/local-settings.js,/usr/lib/firefox-esr/defaults/pref/locall-settings.js

Now, you are root in as sandbox with your two files mounted. You switch to your regular user and start firefox:

# su username
$ firejail --force firefox

The second sandbox (firejail --force firefox) is the one doing all the security, the first one is just setting the filesystem.

@netblue30 commented on GitHub (Aug 13, 2016): I've found out this description about "Locking preferences" on Mozilla site: http://kb.mozillazine.org/Locking_preferences We are gonna have to support it, but for now you can use --bind. Unfortunately, --bind is available only if you start as root, something like this: ``` $ su # firejail --noprofile --bind=/path/mozilla.cfg,/usr/lib/firefox-esr/mozilla.cfg --bind=/path/local-settings.js,/usr/lib/firefox-esr/defaults/pref/locall-settings.js ``` Now, you are root in as sandbox with your two files mounted. You switch to your regular user and start firefox: ``` # su username $ firejail --force firefox ``` The second sandbox (firejail --force firefox) is the one doing all the security, the first one is just setting the filesystem.

gitea-mirror commented

2026-05-05 05:56:22 -06:00

Author

Owner

@unixpipecentipede commented on GitHub (Aug 15, 2016):

Sadly the files must previously exist before binding them:

Error: cannot find /usr/lib/firefox-esr/defaults/pref/local-settings.js for bind command
Error: cannot find /usr/lib/firefox-esr/mozilla.cfg for bind command

Don't know if it's desirable to create non-existing files when using --bind.

@unixpipecentipede commented on GitHub (Aug 15, 2016): Sadly the files must previously exist before binding them: ``` Error: cannot find /usr/lib/firefox-esr/defaults/pref/local-settings.js for bind command Error: cannot find /usr/lib/firefox-esr/mozilla.cfg for bind command ``` Don't know if it's desirable to create non-existing files when using `--bind`.

gitea-mirror commented

2026-05-05 05:56:24 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 15, 2016):

Don't know if it's desirable to create non-existing files when using --bind

No.

@netblue30 commented on GitHub (Aug 15, 2016): > Don't know if it's desirable to create non-existing files when using --bind No.

gitea-mirror commented

2026-05-05 05:56:26 -06:00

Author

Owner

@netblue30 commented on GitHub (Sep 6, 2016):

The purpose of local-settings.js and mozilla.cfg is to lock all the users in a specific firefox configuration. I don't think I can change these files.

@netblue30 commented on GitHub (Sep 6, 2016): The purpose of local-settings.js and mozilla.cfg is to lock all the users in a specific firefox configuration. I don't think I can change these files.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#477

No description provided.

Rows
Columns