[GH-ISSUE #738] Consider improving the documentation of --whitelist #500

New issue

Closed

opened 2026-05-05 05:59:29 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 05:59:29 -06:00

Owner

Originally created by @jody-frankowski on GitHub (Aug 21, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/738

I have just noticed that when you add the --whitelist argument firejail mounts a new /home and a new /root (otherwise it doesn't by default).

firejail --debug --noprofile --whitelist=/home/me/.config/ ls -la
Command name #ls#
DISPLAY :0, 0
Using the local network stack
Parent pid 21391, child pid 21393
Host network configured
Initializing child process
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Mounting read-only /bin, /sbin, /lib, /lib32, /lib64, /usr, /etc, /var
Mounting tmpfs on /var/lock
Mounting tmpfs on /var/tmp
Mounting tmpfs on /var/log
Create the new utmp file
Mount the new utmp file
Cleaning /home directory
Sanitizing /etc/passwd
Sanitizing /etc/group
Disable /etc/firejail
Disable /home/me/.config/firejail
Disable /run/firejail/network
Disable /run/firejail/bandwidth
Disable /run/firejail/name
Disable /run/firejail/x11
Debug 337: new_name #/home/me/.config/#
Replaced whitelist path: whitelist /home/me/.config
Mounting a new /home directory
Mounting a new /root directory
Create a new user directory
Whitelisting /home/me/.config
Remounting /proc and /proc/sys filesystems
Remounting /sys directory
Disable /sys/firmware
Disable /sys/hypervisor
Disable /sys/fs
Disable /sys/module
Disable /sys/power
Disable /proc/sysrq-trigger
Disable /proc/sys/kernel/hotplug
Disable /sys/kernel/uevent_helper
Disable /proc/irq
Disable /proc/bus
Disable /proc/kcore
Disable /proc/kallsyms
Disable /boot directory
Disable /boot
Disable /dev/port
Disable /dev/kmsg
Disable /proc/kmsg

DISPLAY :0, 0
Username me, groups 1000, 10, 169, 315, 150, 996,
Starting "ls" "-la"
execvp argument 0: /bin/bash
execvp argument 1: -c
execvp argument 2: "ls" "-la"
Child process initialized
total 16
drwx------  3 me   me    100 Aug 21 11:24 .
drwxr-xr-x  3 root root   60 Aug 21 11:24 ..
-rw-------  1 me   me    141 Aug 21 11:24 .bashrc
drwxr-xr-x 36 me   me   4096 Aug 20 22:47 .config
-rw-------  1 me   me    101 Aug 21 11:24 .Xauthority
monitoring pid 2

Sandbox monitor: waitpid 2 retval 2 status 0

Parent is shutting down, bye...

I was having a hard time understanding how this was happening in my profile, and i think this might deserver bigger flags :-)

Edit:
I have noticed the documentation for whitelist in man firejail-profile(5) documents this properly, but I think the issue is still on point because the documentation for --whitelist in man firejail(1) isn't the same.

Originally created by @jody-frankowski on GitHub (Aug 21, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/738 I have just noticed that when you add the `--whitelist` argument firejail mounts a new /home and a new /root (otherwise it doesn't by default). ``` sh firejail --debug --noprofile --whitelist=/home/me/.config/ ls -la Command name #ls# DISPLAY :0, 0 Using the local network stack Parent pid 21391, child pid 21393 Host network configured Initializing child process PID namespace installed Mounting tmpfs on /run/firejail/mnt directory Mounting read-only /bin, /sbin, /lib, /lib32, /lib64, /usr, /etc, /var Mounting tmpfs on /var/lock Mounting tmpfs on /var/tmp Mounting tmpfs on /var/log Create the new utmp file Mount the new utmp file Cleaning /home directory Sanitizing /etc/passwd Sanitizing /etc/group Disable /etc/firejail Disable /home/me/.config/firejail Disable /run/firejail/network Disable /run/firejail/bandwidth Disable /run/firejail/name Disable /run/firejail/x11 Debug 337: new_name #/home/me/.config/# Replaced whitelist path: whitelist /home/me/.config Mounting a new /home directory Mounting a new /root directory Create a new user directory Whitelisting /home/me/.config Remounting /proc and /proc/sys filesystems Remounting /sys directory Disable /sys/firmware Disable /sys/hypervisor Disable /sys/fs Disable /sys/module Disable /sys/power Disable /proc/sysrq-trigger Disable /proc/sys/kernel/hotplug Disable /sys/kernel/uevent_helper Disable /proc/irq Disable /proc/bus Disable /proc/kcore Disable /proc/kallsyms Disable /boot directory Disable /boot Disable /dev/port Disable /dev/kmsg Disable /proc/kmsg DISPLAY :0, 0 Username me, groups 1000, 10, 169, 315, 150, 996, Starting "ls" "-la" execvp argument 0: /bin/bash execvp argument 1: -c execvp argument 2: "ls" "-la" Child process initialized total 16 drwx------ 3 me me 100 Aug 21 11:24 . drwxr-xr-x 3 root root 60 Aug 21 11:24 .. -rw------- 1 me me 141 Aug 21 11:24 .bashrc drwxr-xr-x 36 me me 4096 Aug 20 22:47 .config -rw------- 1 me me 101 Aug 21 11:24 .Xauthority monitoring pid 2 Sandbox monitor: waitpid 2 retval 2 status 0 Parent is shutting down, bye... ``` I was having a hard time understanding how this was happening in my profile, and i think this might deserver bigger flags :-) Edit: I have noticed the documentation for `whitelist` in man firejail-profile(5) documents this properly, but I think the issue is still on point because the documentation for `--whitelist` in man firejail(1) isn't the same.

gitea-mirror

2026-05-05 05:59:29 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 05:59:35 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 22, 2016):

Fixed, thanks.

@netblue30 commented on GitHub (Aug 22, 2016): Fixed, thanks.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#500

No description provided.

Rows
Columns