mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #839] Conflict with read-only and noexec #568
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#568
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @valoq on GitHub (Oct 6, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/839
When using read-only together with noexec, the later will override the former.
using a profile with:
read-only ${HOME}
noexec ${HOME}
the path will not be read only and the program can write in the home directory
using noexec and then read-only will lead to the directory being executable.
@nick75e commented on GitHub (Oct 6, 2016):
Hi!
I think your problem is related to #833.
As for
noexec, usingnoexec ${HOME}/*should solve your issue.@valoq commented on GitHub (Oct 6, 2016):
It does solve the issue, however it still is not the expected behavior.
The source of the problem seems to be the way fs_rdonly and fs_noexec remount the filesystem with their specific options only, without reapplying the existing options.
@valoq commented on GitHub (Oct 6, 2016):
One way to solve this might be to get the already applied mount options using something like _PATH_FSTAB (https://www.gnu.org/software/libc/manual/html_node/Mount-Information.html#Mount-Information)
I haven't found any way to remount without overriding the previous mount options.
@chiraag-nataraj commented on GitHub (Oct 6, 2016):
Shouldn't the
remountmount option work? https://www.gnu.org/software/libc/manual/html_node/Mount_002dUnmount_002dRemount.html#Mount_002dUnmount_002dRemount@netblue30 commented on GitHub (Oct 8, 2016):
Definitely a bug, I'll look into it.
@smitsohu commented on GitHub (Oct 21, 2018):
As far as I can tell this is fixed in current Firejail. Please fell free to reopen if you encounter this again.