[GH-ISSUE #700] whitelisting /home/myuser not possible #478

Closed
opened 2026-05-05 05:56:28 -06:00 by gitea-mirror · 10 comments
Owner

Originally created by @frank-github on GitHub (Aug 12, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/700

firejail --noprofile --whitelist=/home/myuser bash
firejail --noprofile --noblacklist=/home/myuser bash

but /home is still empty and firejail has mount a tempory home

how can I config firejail to let /home untouched/readable?

Originally created by @frank-github on GitHub (Aug 12, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/700 firejail --noprofile --whitelist=/home/myuser bash firejail --noprofile --noblacklist=/home/myuser bash but /home is still empty and firejail has mount a tempory home how can I config firejail to let /home untouched/readable?
Author
Owner

@chiraag-nataraj commented on GitHub (Aug 12, 2016):

The first gave me:

Parent pid 8797, child pid 8798
Error: file /home/chiraag is not in user home directory, exiting...
Error: cannot establish communication with the parent, exiting...

The second worked.
I'm using firejail 0.9.42~rc1

<!-- gh-comment-id:239334667 --> @chiraag-nataraj commented on GitHub (Aug 12, 2016): The first gave me: ``` Parent pid 8797, child pid 8798 Error: file /home/chiraag is not in user home directory, exiting... Error: cannot establish communication with the parent, exiting... ``` The second worked. I'm using firejail 0.9.42~rc1
Author
Owner

@frank-github commented on GitHub (Aug 12, 2016):

hupps, forgot to write my used version :(

firejail version 0.9.40
maybe I have to wait for 0.9.42

<!-- gh-comment-id:239375988 --> @frank-github commented on GitHub (Aug 12, 2016): hupps, forgot to write my used version :( firejail version 0.9.40 maybe I have to wait for 0.9.42
Author
Owner

@manevich commented on GitHub (Aug 12, 2016):

@frank-github What you are trying to do?
If /home/myuser is your home directory, then firejail --noprofile gives you full access to files in your home.

<!-- gh-comment-id:239379517 --> @manevich commented on GitHub (Aug 12, 2016): @frank-github What you are trying to do? If `/home/myuser` is your home directory, then `firejail --noprofile` gives you full access to files in your home.
Author
Owner

@frank-github commented on GitHub (Aug 12, 2016):

is it your home?

yes and no
/home/myuser is a symlink to another filesystem, where the real home-dir is located

fgrep myuser /etc/passwd
myuser: x :1000:1000:myuser,,,,:/media/daten/myuser:/bin/bash

/home$ ls -l
lrwxrwxrwx 1 root root 18 Apr 27 2014 myuser -> /media/daten/myuser

I want to run my pdfviewer behind firejail. but it doesn't find anything, if it is called with a file like /home/myuser/example.pdf
firejail create a temporary /home, which is empty

<!-- gh-comment-id:239410921 --> @frank-github commented on GitHub (Aug 12, 2016): > is it your home? yes and no /home/myuser is a symlink to another filesystem, where the real home-dir is located fgrep myuser /etc/passwd myuser: x :1000:1000:myuser,,,,:/media/daten/myuser:/bin/bash /home$ ls -l lrwxrwxrwx 1 root root 18 Apr 27 2014 myuser -> /media/daten/myuser I want to run my pdfviewer behind firejail. but it doesn't find anything, if it is called with a file like /home/myuser/example.pdf firejail create a temporary /home, which is empty
Author
Owner

@manevich commented on GitHub (Aug 12, 2016):

lrwxrwxrwx 1 root root 18 Apr 27 2014 myuser -> /media/daten/myuser

This is cause of problem. Firejail, for obvious reasons, is very strict when it comes to symlinks.
If I recall correctly, there was already some some talk about this matter.

<!-- gh-comment-id:239414870 --> @manevich commented on GitHub (Aug 12, 2016): > lrwxrwxrwx 1 root root 18 Apr 27 2014 myuser -> /media/daten/myuser This is cause of problem. Firejail, for obvious reasons, is very strict when it comes to symlinks. If I recall correctly, there was already some some talk about this matter.
Author
Owner

@manevich commented on GitHub (Aug 12, 2016):

Here it is https://github.com/netblue30/firejail/issues/277.

<!-- gh-comment-id:239415670 --> @manevich commented on GitHub (Aug 12, 2016): Here it is https://github.com/netblue30/firejail/issues/277.
Author
Owner

@netblue30 commented on GitHub (Aug 12, 2016):

Yes, at this time we don't support home directories as symlinks.

<!-- gh-comment-id:239465041 --> @netblue30 commented on GitHub (Aug 12, 2016): Yes, at this time we don't support home directories as symlinks.
Author
Owner

@frank-github commented on GitHub (Aug 12, 2016):

if I would use a mountpoint for my /home/myuser instead of a symlink, would this be supported by firejail?
I'm not a linux expert, don't know if this makes any difference

<!-- gh-comment-id:239495897 --> @frank-github commented on GitHub (Aug 12, 2016): if I would use a mountpoint for my /home/myuser instead of a symlink, would this be supported by firejail? I'm not a linux expert, don't know if this makes any difference
Author
Owner

@manevich commented on GitHub (Aug 12, 2016):

if I would use a mountpoint for my /home/myuser instead of a symlink, would this be supported by firejail?

This should work.

<!-- gh-comment-id:239545137 --> @manevich commented on GitHub (Aug 12, 2016): > if I would use a mountpoint for my /home/myuser instead of a symlink, would this be supported by firejail? This should work.
Author
Owner

@frank-github commented on GitHub (Aug 13, 2016):

mountpoint works 👍

thanks for all the help

<!-- gh-comment-id:239588245 --> @frank-github commented on GitHub (Aug 13, 2016): mountpoint works :+1: thanks for all the help
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#478
No description provided.