github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #911] Read files from system #617

New issue

Closed

opened 2026-05-05 06:17:17 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 06:17:17 -06:00

Owner

Originally created by @peterzhu2118 on GitHub (Nov 13, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/911

How can I whitelist a folder so that it reads from the outer system and not from inside the sandbox (i.e. I have a code file in the system, how can I run that in sandboxed mode)?

Originally created by @peterzhu2118 on GitHub (Nov 13, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/911 How can I whitelist a folder so that it reads from the outer system and not from inside the sandbox (i.e. I have a code file in the system, how can I run that in sandboxed mode)?

gitea-mirror

2026-05-05 06:17:17 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 06:17:23 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 15, 2016):

You can use --blacklist=somefolder. The folder will be visible outside the sandbox. In the sandbox the folder will be empty, with no read access to the regular user.

@netblue30 commented on GitHub (Nov 15, 2016): You can use --blacklist=somefolder. The folder will be visible outside the sandbox. In the sandbox the folder will be empty, with no read access to the regular user.

gitea-mirror commented

2026-05-05 06:17:26 -06:00

Author

Owner

@peterzhu2118 commented on GitHub (Nov 16, 2016):

I don't think you are understanding the question, let me rephrase it. Lets say we have a file called file.txt in location /home/user/file.txt. How can I make it so that that file is accessible within firejail?

@peterzhu2118 commented on GitHub (Nov 16, 2016): I don't think you are understanding the question, let me rephrase it. Lets say we have a file called file.txt in location `/home/user/file.txt`. How can I make it so that that file is accessible within firejail?

gitea-mirror commented

2026-05-05 06:17:29 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 18, 2016):

By default most of the files are available in the sandbox. What file are you trying out?

@netblue30 commented on GitHub (Nov 18, 2016): By default most of the files are available in the sandbox. What file are you trying out?

gitea-mirror commented

2026-05-05 06:17:31 -06:00

Author

Owner

@peterzhu2118 commented on GitHub (Nov 18, 2016):

So if I go into my /home/ folder in firejail, it it empty even through it contains a ton of stuff in the actual system. This is the profile I am using:

include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc

private
private-dev
nosound
no3d
private-tmp
blacklist /tmp/.X11-unix
seccomp

This is my firejail.config file (minus the comments):

network no
quiet-by-default yes

@peterzhu2118 commented on GitHub (Nov 18, 2016): So if I go into my /home/ folder in firejail, it it empty even through it contains a ton of stuff in the actual system. This is the profile I am using: ``` include /etc/firejail/disable-common.inc include /etc/firejail/disable-programs.inc include /etc/firejail/disable-passwdmgr.inc private private-dev nosound no3d private-tmp blacklist /tmp/.X11-unix seccomp ``` This is my firejail.config file (minus the comments): ``` network no quiet-by-default yes ```

gitea-mirror commented

2026-05-05 06:17:34 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 19, 2016):

private

In your profile file, this is the line that is creating the problem. It will mask almost all the files in your home directory. You will be left with a small skeleton:

$ firejail --private
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-passwdmgr.inc

** Note: you can use --noprofile to disable default.profile **

Parent pid 16287, child pid 16288
Child process initialized
[netblue@debian ~]$ ls -l
total 0
[netblue@debian ~]$ ls -al
total 28
drwx------ 3 netblue netblue   120 Nov 19 11:31 .
drwxr-xr-x 3   65534   65534    60 Nov 19 11:31 ..
-rw------- 1 netblue netblue     0 Nov 19 11:31 .asoundrc
-rw-r--r-- 1 netblue netblue  3515 Nov 19 11:31 .bashrc
drwxr-xr-x 3 netblue netblue    60 Nov 19 11:31 .config
-rw------- 1 netblue netblue 21123 Nov 19 11:31 .Xauthority

You might want to look into using whitelists, where you get the same skeleton plus the files you specify in whitelist command. Look for an example in /etc/firejail/firefox.

@netblue30 commented on GitHub (Nov 19, 2016): > private In your profile file, this is the line that is creating the problem. It will mask almost all the files in your home directory. You will be left with a small skeleton: ``` $ firejail --private Reading profile /etc/firejail/default.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-passwdmgr.inc ** Note: you can use --noprofile to disable default.profile ** Parent pid 16287, child pid 16288 Child process initialized [netblue@debian ~]$ ls -l total 0 [netblue@debian ~]$ ls -al total 28 drwx------ 3 netblue netblue 120 Nov 19 11:31 . drwxr-xr-x 3 65534 65534 60 Nov 19 11:31 .. -rw------- 1 netblue netblue 0 Nov 19 11:31 .asoundrc -rw-r--r-- 1 netblue netblue 3515 Nov 19 11:31 .bashrc drwxr-xr-x 3 netblue netblue 60 Nov 19 11:31 .config -rw------- 1 netblue netblue 21123 Nov 19 11:31 .Xauthority ``` You might want to look into using whitelists, where you get the same skeleton plus the files you specify in whitelist command. Look for an example in /etc/firejail/firefox.

gitea-mirror referenced this issue

2026-05-05 10:06:00 -06:00

[PR #617] [MERGED] Fix chdir bug in libtracelog #3686

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#617

No description provided.

Rows
Columns