[PR #6390] [MERGED] feature: add notpm command & keep tpm devices in private-dev #5993

New issue

Closed

opened 2026-05-05 10:48:44 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 10:48:44 -06:00

Owner

📋 Pull Request Information

Original PR: https://github.com/netblue30/firejail/pull/6390
Author: @qdii
Created: 6/22/2024
Status: ✅ Merged
Merged: 7/9/2024
Merged by: @kmk3

Base: master ← Head: master

📝 Commits (1)

8bfc334 feature: add notpm command & keep tpm devices in private-dev

📊 Changes

13 files changed (+56 additions, -8 deletions)

View changed files

📝 contrib/syntax/lists/profile_commands_arg0.list (+1 -0)
📝 etc/profile-a-l/default.profile (+1 -0)
📝 etc/templates/profile.template (+1 -0)
📝 src/fbuilder/build_profile.c (+1 -0)
📝 src/firejail/firejail.h (+2 -0)
📝 src/firejail/fs_dev.c (+17 -0)
📝 src/firejail/main.c (+3 -0)
📝 src/firejail/profile.c (+4 -0)
📝 src/firejail/sandbox.c (+3 -0)
📝 src/firejail/usage.c (+1 -0)
📝 src/man/firejail-profile.5.in (+7 -4)
📝 src/man/firejail.1.in (+14 -4)
📝 src/zsh_completion/_firejail.in (+1 -0)

📄 Description

An ssh private key may be stored in a Trusted Platform Module (TPM)
device and private-dev in ssh.profile currently breaks this use-case,
as it does not keep tpm devices (see #6379).

So add a new notpm command and keep tpm devices in /dev by default
with private-dev unless notpm is used.

Tested locally with:

❯ /usr/local/bin/firejail --private-dev --noprofile stat /dev/tpm0
firejail version 0.9.73

Parent pid 34059, child pid 34060
Base filesystem installed in 0.03 ms
Child process initialized in 13.23 ms
  File: /dev/tpm0
  Size: 0         	Blocks: 0          IO Block: 4096   character special file
Device: 0,6	Inode: 150         Links: 1     Device type: 10,224
Access: (0600/crw-------)  Uid: (  973/     tss)   Gid: (  973/     tss)
Access: 2024-06-22 11:20:44.017230197 +0200
Modify: 2024-06-22 11:20:44.017230197 +0200
Change: 2024-06-22 11:20:44.017230197 +0200
 Birth: 2024-06-22 11:20:10.406666659 +0200

Parent is shutting down, bye...

Fixes #6379.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/netblue30/firejail/pull/6390 **Author:** [@qdii](https://github.com/qdii) **Created:** 6/22/2024 **Status:** ✅ Merged **Merged:** 7/9/2024 **Merged by:** [@kmk3](https://github.com/kmk3) **Base:** `master` ← **Head:** `master` --- ### 📝 Commits (1) - [`8bfc334`](https://github.com/netblue30/firejail/commit/8bfc3345001a6fca7a653a6a8905617ba1decd34) feature: add notpm command & keep tpm devices in private-dev ### 📊 Changes **13 files changed** (+56 additions, -8 deletions) <details> <summary>View changed files</summary> 📝 `contrib/syntax/lists/profile_commands_arg0.list` (+1 -0) 📝 `etc/profile-a-l/default.profile` (+1 -0) 📝 `etc/templates/profile.template` (+1 -0) 📝 `src/fbuilder/build_profile.c` (+1 -0) 📝 `src/firejail/firejail.h` (+2 -0) 📝 `src/firejail/fs_dev.c` (+17 -0) 📝 `src/firejail/main.c` (+3 -0) 📝 `src/firejail/profile.c` (+4 -0) 📝 `src/firejail/sandbox.c` (+3 -0) 📝 `src/firejail/usage.c` (+1 -0) 📝 `src/man/firejail-profile.5.in` (+7 -4) 📝 `src/man/firejail.1.in` (+14 -4) 📝 `src/zsh_completion/_firejail.in` (+1 -0) </details> ### 📄 Description An ssh private key may be stored in a Trusted Platform Module (TPM) device and `private-dev` in ssh.profile currently breaks this use-case, as it does not keep tpm devices (see #6379). So add a new `notpm` command and keep tpm devices in /dev by default with `private-dev` unless `notpm` is used. Tested locally with: ``` ❯ /usr/local/bin/firejail --private-dev --noprofile stat /dev/tpm0 firejail version 0.9.73 Parent pid 34059, child pid 34060 Base filesystem installed in 0.03 ms Child process initialized in 13.23 ms File: /dev/tpm0 Size: 0 Blocks: 0 IO Block: 4096 character special file Device: 0,6 Inode: 150 Links: 1 Device type: 10,224 Access: (0600/crw-------) Uid: ( 973/ tss) Gid: ( 973/ tss) Access: 2024-06-22 11:20:44.017230197 +0200 Modify: 2024-06-22 11:20:44.017230197 +0200 Change: 2024-06-22 11:20:44.017230197 +0200 Birth: 2024-06-22 11:20:10.406666659 +0200 Parent is shutting down, bye... ``` Fixes #6379. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

gitea-mirror

2026-05-05 10:48:44 -06:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#5993

No description provided.

Rows
Columns