github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #6] Cannot blacklist ${HOME}/.config/firejail #5

New issue
Closed
opened 2026-05-05 04:42:41 -06:00 by gitea-mirror · 7 comments
gitea-mirror commented 2026-05-05 04:42:41 -06:00
Owner
Copy link

Originally created by @boltronics on GitHub (Aug 10, 2015).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6

I was surprised there was no line in the default configuration like so:

blacklist ${HOME}/.config/firejail

Without that, an untrusted app could modify its own firejail profile and terminate. When it is relaunched (either automatically via a service management daemon or via user intervention), it could run with elevated privileges.

Even more surprising, manually adding the entry does nothing - the line is silently ignored.

Originally created by @boltronics on GitHub (Aug 10, 2015). Original GitHub issue: https://github.com/netblue30/firejail/issues/6 I was surprised there was no line in the default configuration like so: `blacklist ${HOME}/.config/firejail` Without that, an untrusted app could modify its own firejail profile and terminate. When it is relaunched (either automatically via a service management daemon or via user intervention), it could run with elevated privileges. Even more surprising, manually adding the entry does nothing - the line is silently ignored.
gitea-mirror added the
invalid
 label 2026-05-05 04:42:41 -06:00
gitea-mirror commented 2026-05-05 04:42:50 -06:00
Author
Owner
Copy link

@netblue30 commented on GitHub (Aug 12, 2015):

It seems to be working for me:

$ cat ttt
blacklist ${HOME}/.config/firejail
$ firejail --profile=ttt
Reading profile ttt
Parent pid 24098, child pid 24099
Child process initialized
$ ls ~/.config/firejail
ls: cannot open directory /home/netblue/.config/firejail: Permission denied
$

<!-- gh-comment-id:130354632 --> @netblue30 commented on GitHub (Aug 12, 2015): It seems to be working for me: $ cat ttt blacklist ${HOME}/.config/firejail $ firejail --profile=ttt Reading profile ttt Parent pid 24098, child pid 24099 Child process initialized $ ls ~/.config/firejail ls: cannot open directory /home/netblue/.config/firejail: Permission denied $
gitea-mirror commented 2026-05-05 04:42:54 -06:00
Author
Owner
Copy link

@boltronics commented on GitHub (Aug 15, 2015):

I just tried with the latest from git, and this is still a problem for me, so I digged deeper.

Since I'm using GNU Stow to manage my dotfiles, ~/.config/firejail is actually a symlink. Apparently firejail doesn't support following symlinks, which means many of the default profiles aren't protecting my setup at all. This is a worry.

I believe firejail should be resolving the actual location and blocking that (where blacklist ${HOME}/.config/firejail would effectively be equivalent to blacklist $(readlink -f ${HOME}/.config/firejail).

Please see this link for more information on how it could be done in C:
https://stackoverflow.com/questions/7665/how-to-resolve-symbolic-links-in-a-shell-script

I think this can now be re-opened, or otherwise let me know if you would prefer me to open a new issue.

<!-- gh-comment-id:131275952 --> @boltronics commented on GitHub (Aug 15, 2015): I just tried with the latest from git, and this is still a problem for me, so I digged deeper. Since I'm using GNU Stow to manage my dotfiles, ~/.config/firejail is actually a symlink. Apparently firejail doesn't support following symlinks, which means many of the default profiles aren't protecting my setup at all. This is a worry. I believe firejail should be resolving the actual location and blocking that (where `blacklist ${HOME}/.config/firejail` would effectively be equivalent to `blacklist $(readlink -f ${HOME}/.config/firejail)`. Please see this link for more information on how it could be done in C: https://stackoverflow.com/questions/7665/how-to-resolve-symbolic-links-in-a-shell-script I think this can now be re-opened, or otherwise let me know if you would prefer me to open a new issue.
gitea-mirror commented 2026-05-05 04:42:57 -06:00
Author
Owner
Copy link

@ghost commented on GitHub (Aug 15, 2015):

@boltronics I currently can't reproduce this, I tried blacklisting a symlinked directory and it works fine. It follows the symlink and blocks what it points to. We'd need to know what you're seeing on your machine. Can you please let us know:

  1. The command you run to test whether the blocking is working
  2. The output you see from the command, that tells you firejail isn't blocking properly
  3. What you would expect to see if firejail was working correctly.
<!-- gh-comment-id:131356769 --> @ghost commented on GitHub (Aug 15, 2015): @boltronics I currently can't reproduce this, I tried blacklisting a symlinked directory and it works fine. It follows the symlink and blocks what it points to. We'd need to know what you're seeing on your machine. Can you please let us know: 1. The command you run to test whether the blocking is working 2. The output you see from the command, that tells you firejail isn't blocking properly 3. What you would expect to see if firejail was working correctly.
gitea-mirror commented 2026-05-05 04:42:59 -06:00
Author
Owner
Copy link

@boltronics commented on GitHub (Aug 15, 2015):

@pmillerchip
Strange. I can't see any way to avoid it. :)

1 and 2 - commands and output:

boltron@laptop:~$ ls -ld .config/firejail
lrwxrwxrwx 1 boltron boltron 38 Aug 10 00:38 .config/firejail -> ../stow/firejail/.config/firejail
boltron@laptop:~$ cat ~/.config/firejail/bash.profile 
blacklist /home/boltron/.config/firejail
boltron@laptop:~$ firejail --profile=${HOME}/.config/firejail/bash.profile bash
Reading profile /home/boltron/.config/firejail/bash.profile
Parent pid 30569, child pid 30570
Child process initialized
[boltron@laptop ~]$ ls -l .config/firejail/bash.profile
-rw-r--r-- 1 boltron boltron 40 Aug 16 05:17 .config/firejail/bash.profile
[boltron@laptop ~]$

3 - expected output:

boltron@laptop:~$ ls -ld .config/firejail
lrwxrwxrwx 1 boltron boltron 38 Aug 10 00:38 .config/firejail -> ../stow/firejail/.config/firejail
boltron@laptop:~$ cat ~/.config/firejail/bash.profile 
blacklist /home/boltron/.config/firejail
boltron@laptop:~$ firejail --profile=${HOME}/.config/firejail/bash.profile bash
Reading profile /home/boltron/.config/firejail/bash.profile
Parent pid 30569, child pid 30570
Child process initialized
[boltron@laptop ~]$ ls -l .config/firejail/bash.profile
ls: cannot access .config/firejail/bash.profile: Permission denied
[boltron@laptop ~]$
<!-- gh-comment-id:131431643 --> @boltronics commented on GitHub (Aug 15, 2015): @pmillerchip Strange. I can't see any way to avoid it. :) 1 and 2 - commands and output: ``` boltron@laptop:~$ ls -ld .config/firejail lrwxrwxrwx 1 boltron boltron 38 Aug 10 00:38 .config/firejail -> ../stow/firejail/.config/firejail boltron@laptop:~$ cat ~/.config/firejail/bash.profile blacklist /home/boltron/.config/firejail boltron@laptop:~$ firejail --profile=${HOME}/.config/firejail/bash.profile bash Reading profile /home/boltron/.config/firejail/bash.profile Parent pid 30569, child pid 30570 Child process initialized [boltron@laptop ~]$ ls -l .config/firejail/bash.profile -rw-r--r-- 1 boltron boltron 40 Aug 16 05:17 .config/firejail/bash.profile [boltron@laptop ~]$ ``` 3 - expected output: ``` boltron@laptop:~$ ls -ld .config/firejail lrwxrwxrwx 1 boltron boltron 38 Aug 10 00:38 .config/firejail -> ../stow/firejail/.config/firejail boltron@laptop:~$ cat ~/.config/firejail/bash.profile blacklist /home/boltron/.config/firejail boltron@laptop:~$ firejail --profile=${HOME}/.config/firejail/bash.profile bash Reading profile /home/boltron/.config/firejail/bash.profile Parent pid 30569, child pid 30570 Child process initialized [boltron@laptop ~]$ ls -l .config/firejail/bash.profile ls: cannot access .config/firejail/bash.profile: Permission denied [boltron@laptop ~]$ ```
gitea-mirror commented 2026-05-05 04:43:02 -06:00
Author
Owner
Copy link

@ghost commented on GitHub (Aug 15, 2015):

OK I found (and fixed) the problem! @boltronics had a relative symlink (i.e. it started with ../) and firejail wasn't handling that right.

@netblue30 : I've made a pull request to fix this, it just calls the realpath standard library function to do all the hard work for us, and it fixes the problem.

@boltronics : Please compile firejail from the symlink-bug branch of my firejail repo here: https://github.com/pmillerchip/firejail.git ...and let me know if it fixes it for you.

<!-- gh-comment-id:131447062 --> @ghost commented on GitHub (Aug 15, 2015): OK I found (and fixed) the problem! @boltronics had a relative symlink (i.e. it started with `../`) and firejail wasn't handling that right. @netblue30 : I've made a pull request to fix this, it just calls the `realpath` standard library function to do all the hard work for us, and it fixes the problem. @boltronics : Please compile firejail from the `symlink-bug` branch of my firejail repo here: https://github.com/pmillerchip/firejail.git ...and let me know if it fixes it for you.
gitea-mirror commented 2026-05-05 04:43:04 -06:00
Author
Owner
Copy link

@boltronics commented on GitHub (Aug 16, 2015):

@pmillerchip Thanks for the quick patch! It's definitely making a difference, but not the right kind of difference. :)

Edit:
Sorry. I clearly looked at this too early in the morning, and made a mistake. The patch works fine. :)

<!-- gh-comment-id:131490456 --> @boltronics commented on GitHub (Aug 16, 2015): @pmillerchip Thanks for the quick patch! It's definitely making a difference, but not the right kind of difference. :) Edit: Sorry. I clearly looked at this too early in the morning, and made a mistake. The patch works fine. :)
gitea-mirror commented 2026-05-05 04:43:05 -06:00
Author
Owner
Copy link

@ghost commented on GitHub (Aug 16, 2015):

That's great news, glad it works for you. The pull request is up, so hopefully @netblue30 will merge it soon.

<!-- gh-comment-id:131520774 --> @ghost commented on GitHub (Aug 16, 2015): That's great news, glad it works for you. The pull request is up, so hopefully @netblue30 will merge it soon.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#5
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?