github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #110] Whitelist scripts to be executed #67

New issue

Closed

opened 2026-05-05 04:56:32 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 04:56:32 -06:00

Owner

Originally created by @blueyed on GitHub (Oct 29, 2015).
Original GitHub issue: https://github.com/netblue30/firejail/issues/110

I am using a script for the editor setting in Vimperator (a Firefox plugin):

: ${TERM_INSTANCE_NAME:=vterm}

# Gets eval'd in .zshrc.
ZSHRC_EXEC_COMMAND="nvim ${${(qz)@}}"
export ZSHRC_EXEC_COMMAND

exec urxvt -name $TERM_INSTANCE_NAME \
  -icon /usr/share/icons/hicolor/48x48/apps/vim.png \
  -e zsh -i

After whitelisting the script itself, it can be executed, but then fails because the shell's resource files (~/.zshrc etc) are not readable.
Adding ~/.zshrc to the whitelist does not work, probably because it's a symlink (see https://github.com/netblue30/firejail/issues/105#issuecomment-151809628), but it would probably require to also whitelist all files that get sourced from there.

I wonder if it would be possible to have something like with ssh's command= in authorized_keys or in sudoers, where you could whitelist some program to be executed. This way I could say whitelist_program /path/to/vim-in-term.

Originally created by @blueyed on GitHub (Oct 29, 2015). Original GitHub issue: https://github.com/netblue30/firejail/issues/110 I am using a script for the `editor` setting in Vimperator (a Firefox plugin): ``` : ${TERM_INSTANCE_NAME:=vterm} # Gets eval'd in .zshrc. ZSHRC_EXEC_COMMAND="nvim ${${(qz)@}}" export ZSHRC_EXEC_COMMAND exec urxvt -name $TERM_INSTANCE_NAME \ -icon /usr/share/icons/hicolor/48x48/apps/vim.png \ -e zsh -i ``` After whitelisting the script itself, it can be executed, but then fails because the shell's resource files (`~/.zshrc` etc) are not readable. Adding `~/.zshrc` to the whitelist does not work, probably because it's a symlink (see https://github.com/netblue30/firejail/issues/105#issuecomment-151809628), but it would probably require to also whitelist all files that get sourced from there. I wonder if it would be possible to have something like with ssh's `command=` in `authorized_keys` or in `sudoers`, where you could whitelist some program to be executed. This way I could say `whitelist_program /path/to/vim-in-term`.

gitea-mirror closed this issue

2026-05-05 04:56:34 -06:00

gitea-mirror commented

2026-05-05 04:56:37 -06:00

Author

Owner

@netblue30 commented on GitHub (Oct 30, 2015):

If you go this way, you'll end up whitelisting everything in your home directory. Maybe a better way is to create a new directory and push it to firejail using --private=directory:

$ cd ~
$ mkdir mybrowser
$ cd mybrowser
$ mv ../Downloads .
$ mv ../.mozilla .
(bring in here any other files you need)
$ cd ..
$ firejail --private=mybrowser firefox
...

I use --private=directory myself.

@netblue30 commented on GitHub (Oct 30, 2015): If you go this way, you'll end up whitelisting everything in your home directory. Maybe a better way is to create a new directory and push it to firejail using --private=directory: ``` $ cd ~ $ mkdir mybrowser $ cd mybrowser $ mv ../Downloads . $ mv ../.mozilla . (bring in here any other files you need) $ cd .. $ firejail --private=mybrowser firefox ... ``` I use --private=directory myself.

gitea-mirror commented

2026-05-05 04:56:40 -06:00

Author

Owner

@blueyed commented on GitHub (Nov 1, 2015):

Thanks for your support on this!

What about whitelisting programs, which would then run in the user's context, similar to what SSH allows with command=?
Maintaining a separate browser directory seems to be a bit overkill, when I want to only use an external editor (in a terminal).

@blueyed commented on GitHub (Nov 1, 2015): Thanks for your support on this! What about whitelisting programs, which would then run in the user's context, similar to what SSH allows with `command=`? Maintaining a separate browser directory seems to be a bit overkill, when I want to only use an external editor (in a terminal).

gitea-mirror commented

2026-05-05 04:56:43 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 2, 2015):

Something else you could do is --private-bin. This allows you to specify the content of your /bin directory. Example:

$ firejail --private-bin=bash,sh,ps,grep,test,kde4-config /usr/lib/iceweasel/iceweasel

Replace iceweasel with firefox if necessary. Once the browser is open, type "/bin" in the url field, and it will show you the content of /bin directory. /sbin, /usr/bin and /usr/sbin look the same as /bin.

@netblue30 commented on GitHub (Nov 2, 2015): Something else you could do is --private-bin. This allows you to specify the content of your /bin directory. Example: ``` $ firejail --private-bin=bash,sh,ps,grep,test,kde4-config /usr/lib/iceweasel/iceweasel ``` Replace iceweasel with firefox if necessary. Once the browser is open, type "/bin" in the url field, and it will show you the content of /bin directory. /sbin, /usr/bin and /usr/sbin look the same as /bin.

gitea-mirror commented

2026-05-05 04:56:46 -06:00

Author

Owner

@blueyed commented on GitHub (Nov 2, 2015):

But will that include e.g. ~/.zshrc etc?

My idea is to allow for a whitelisted program to run in the "normal"/full context again.

@blueyed commented on GitHub (Nov 2, 2015): But will that include e.g. ~/.zshrc etc? My idea is to allow for a whitelisted program to run in the "normal"/full context again.

gitea-mirror commented

2026-05-05 04:56:47 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 3, 2015):

An example:

$ firejail --whitelist=work
Reading profile /etc/firejail/generic.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc

** Note: you can use --noprofile to disable generic.profile **

Parent pid 3299, child pid 3300
Child process initialized
$ ls -al
total 12
drwx------  3 netblue netblue  100 Nov  3 07:51 .
drwxr-xr-x  3 nobody  nogroup   60 Nov  3 07:51 ..
-rw-r--r--  1 netblue netblue 3392 Nov  3 07:51 .bashrc
drwxr-xr-x 23 netblue netblue 4096 Oct  2 11:41 work
-rw-------  1 netblue netblue   51 Nov  3 07:51 .Xauthority

I bring in the sandbox my ~/work directory (requested by whitelist), .Xauthority (to get X11 running), and a default version of .bashrc (from /etc/skel directory). I guess I can bring in also a .zshrc, but I need a default one.

@netblue30 commented on GitHub (Nov 3, 2015): An example: ``` $ firejail --whitelist=work Reading profile /etc/firejail/generic.profile Reading profile /etc/firejail/disable-mgmt.inc Reading profile /etc/firejail/disable-secret.inc Reading profile /etc/firejail/disable-common.inc ** Note: you can use --noprofile to disable generic.profile ** Parent pid 3299, child pid 3300 Child process initialized $ ls -al total 12 drwx------ 3 netblue netblue 100 Nov 3 07:51 . drwxr-xr-x 3 nobody nogroup 60 Nov 3 07:51 .. -rw-r--r-- 1 netblue netblue 3392 Nov 3 07:51 .bashrc drwxr-xr-x 23 netblue netblue 4096 Oct 2 11:41 work -rw------- 1 netblue netblue 51 Nov 3 07:51 .Xauthority ``` I bring in the sandbox my ~/work directory (requested by whitelist), .Xauthority (to get X11 running), and a default version of .bashrc (from /etc/skel directory). I guess I can bring in also a .zshrc, but I need a default one.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#67

No description provided.

Rows
Columns