[GH-ISSUE #1018] Issue with --noblacklist having no effect

gitea-mirror commented

2026-05-05 06:27:53 -06:00

Owner

Originally created by @kyonifer on GitHub (Jan 2, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1018

I'm on arch linux with firejail-git on master (410602c). Following the manpage example:

$ firejail --noblacklist=/bin/nc
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Warning: noroot option is not available

** Note: you can use --noprofile to disable default.profile **

Parent pid 5584, child pid 5585
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Child process initialized
$ nc
bash: /usr/bin/nc: Permission denied

Trying to access nc with some other combinations:

Copying default.profile somewhere and adding noblacklist lines -> permission denied
Copying default.profile somewhere and commenting out the include /etc/firejail/disable-common.inc line -> granted
Running with --noprofile -> granted
Running with --noprofile --blacklist=/bin/nc -> permission denied
Running with --noprofile --blacklist=/bin/nc --noblacklist=/bin/nc -> permission denied

Originally created by @kyonifer on GitHub (Jan 2, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1018 I'm on arch linux with firejail-git on master (410602c). Following the manpage example: ``` $ firejail --noblacklist=/bin/nc Reading profile /etc/firejail/default.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-passwdmgr.inc Warning: noroot option is not available ** Note: you can use --noprofile to disable default.profile ** Parent pid 5584, child pid 5585 Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Child process initialized $ nc bash: /usr/bin/nc: Permission denied ``` Trying to access `nc` with some other combinations: 1. Copying default.profile somewhere and adding noblacklist lines -> permission denied 2. Copying default.profile somewhere and commenting out the `include /etc/firejail/disable-common.inc` line -> granted 3. Running with `--noprofile` -> granted 4. Running with `--noprofile --blacklist=/bin/nc` -> permission denied 5. Running with `--noprofile --blacklist=/bin/nc --noblacklist=/bin/nc` -> permission denied

gitea-mirror

2026-05-05 06:27:53 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 06:27:59 -06:00

Author

Owner

@reinerh commented on GitHub (Jan 2, 2017):

$ firejail --noblacklist=/bin/nc
...
$ nc
bash: /usr/bin/nc: Permission denied

You are noblacklisting /bin/nc, but your nc is in /usr/bin.

@reinerh commented on GitHub (Jan 2, 2017): > $ firejail --noblacklist=**/bin/nc** > ... > $ nc > bash: **/usr/bin/nc**: Permission denied You are noblacklisting /bin/nc, but your nc is in /usr/bin.

gitea-mirror commented

2026-05-05 06:28:02 -06:00

Author

Owner

@kyonifer commented on GitHub (Jan 2, 2017):

/bin is a symlink to /usr/bin on arch. I've tried with firejail --noblacklist=/usr/bin/nc --noblacklist=/bin/nc to make sure it wasnt an issue with following the symlink. Sorry I should have included those in the original ticket.

It seems like --blacklist follows syms since it blocks nc with --noprofile --blacklist=/bin/nc.

@kyonifer commented on GitHub (Jan 2, 2017): /bin is a symlink to /usr/bin on arch. I've tried with `firejail --noblacklist=/usr/bin/nc --noblacklist=/bin/nc` to make sure it wasnt an issue with following the symlink. Sorry I should have included those in the original ticket. It seems like `--blacklist` follows syms since it blocks `nc` with `--noprofile --blacklist=/bin/nc`.

gitea-mirror commented

2026-05-05 06:28:05 -06:00

Author

Owner

@viking777 commented on GitHub (Jan 3, 2017):

I have been having a similar issue to this on Manjaro when using Keepassx (actually keepassx2 - but I am sure that makes no difference).

keepassx.profile file contains the line 'noblacklist ${HOME}/.kdbx' which should override the 'disable-common.inc' line 'blacklist ${HOME}/.kdbx' but it doesn't.
The result is a permission denied message when trying to open keepassx.
If I run with the --noprofile option then keepassx works.
Similarly if I comment out 'blacklist ${HOME}/*.kdbx' from disable-common.inc keepassx will work.

I conclude, as the OP states in the title that 'noblacklist' lines are being ignored in some cases.

@viking777 commented on GitHub (Jan 3, 2017): I have been having a similar issue to this on Manjaro when using Keepassx (actually keepassx2 - but I am sure that makes no difference). keepassx.profile file contains the line 'noblacklist ${HOME}/*.kdbx' which should override the 'disable-common.inc' line 'blacklist ${HOME}/*.kdbx' but it doesn't. The result is a permission denied message when trying to open keepassx. If I run with the --noprofile option then keepassx works. Similarly if I comment out 'blacklist ${HOME}/*.kdbx' from disable-common.inc keepassx will work. I conclude, as the OP states in the title that 'noblacklist' lines are being ignored in some cases.

gitea-mirror commented

2026-05-05 06:28:08 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 24, 2018):

The problem is that the noblacklist lines have to go before the blacklist lines. So any noblacklists that you want to override built-in blacklist commands need to go in a custom profile and can't be done on the command-line. @netblue30 I don't know if this is fixable, given that we parse and apply things in order (rather than parsing everything first and then applying (no)blacklist directives). I'm going to change this to information for now, and we should probably document this in the man pages if nothing else.

@chiraag-nataraj commented on GitHub (Aug 24, 2018): The problem is that the `noblacklist` lines have to go _before_ the `blacklist` lines. So any `noblacklist`s that you want to override built-in `blacklist` commands _need_ to go in a custom profile and can't be done on the command-line. @netblue30 I don't know if this is fixable, given that we parse and apply things in order (rather than parsing everything first and _then_ applying `(no)blacklist` directives). I'm going to change this to `information` for now, and we should probably document this in the man pages if nothing else.

gitea-mirror commented

2026-05-05 06:28:11 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 1, 2020):

Any progress here?

@rusty-snake commented on GitHub (Apr 1, 2020): Any progress here?

gitea-mirror commented

2026-05-05 06:28:13 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 1, 2020):

--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1253,6 +1253,10 @@ $ firejail \-\-noautopulse firefox
 .TP
 \fB\-\-noblacklist=dirname_or_filename
 Disable blacklist for this directory or file.
+
+Two conditions must be met to make noblacklist work:
+1. The noblacklist statement must come before the corresponding blacklist statement
+2. The path to be noblacklisted must match the path of the blacklist statement
 .br
 
 .br

@rusty-snake commented on GitHub (Apr 1, 2020): ```patch --- a/src/man/firejail.txt +++ b/src/man/firejail.txt @@ -1253,6 +1253,10 @@ $ firejail \-\-noautopulse firefox .TP \fB\-\-noblacklist=dirname_or_filename Disable blacklist for this directory or file. + +Two conditions must be met to make noblacklist work: +1. The noblacklist statement must come before the corresponding blacklist statement +2. The path to be noblacklisted must match the path of the blacklist statement .br .br ```

gitea-mirror commented

2026-05-05 06:28:15 -06:00

Author

Owner

@fenuks commented on GitHub (Apr 23, 2021):

I have somewhat related issue that is present for me in both stable version and latest git.

Stable version doesn't have fixes for changes in Jetbains IDE configuration paths yet.

I thought I'd add 'noblacklist ${HOME}/.config/Google/to~/.config/firejail/android-studio.local. My local configuration is read, but it doesn't work, there is no access to that directory inside firejail sandbox, BUT if I add that very line to /etc/firejail/android-studio.profile` instead, it works as expected. Local profile is read before any blacklists, so I suspect a bug.

Just in case, I'm running Arch Linux with 5.11.16 kernel.

@fenuks commented on GitHub (Apr 23, 2021): I have somewhat related issue that is present for me in both stable version and latest git. Stable version doesn't have fixes for changes in Jetbains IDE configuration paths yet. I thought I'd add 'noblacklist ${HOME}/.config/Google/` to `~/.config/firejail/android-studio.local`. My local configuration is read, but it doesn't work, there is no access to that directory inside firejail sandbox, BUT if I add that very line to `/etc/firejail/android-studio.profile` instead, it works as expected. Local profile is read before any blacklists, so I suspect a bug. Just in case, I'm running Arch Linux with 5.11.16 kernel.

gitea-mirror commented

2026-05-05 06:28:16 -06:00

Author

Owner

@ghost commented on GitHub (Apr 23, 2021):

@fenuks Does it change anything if you drop the last / and use noblacklist ${HOME}/.config/Google? Or is this a typo?

@ghost commented on GitHub (Apr 23, 2021): @fenuks Does it change anything if you drop the last / and use `noblacklist ${HOME}/.config/Google`? Or is this a typo?

gitea-mirror commented

2026-05-05 06:28:17 -06:00

Author

Owner

@fenuks commented on GitHub (Apr 24, 2021):

Thank you! That was it. I'd copied path without trailing slash into /etc/firejail/android-studio.profile from my local file without noticing. I didn't know that trailing slash makes difference here.

@fenuks commented on GitHub (Apr 24, 2021): Thank you! That was it. I'd copied path without trailing slash into `/etc/firejail/android-studio.profile` from my local file without noticing. I didn't know that trailing slash makes difference here.

gitea-mirror commented

2026-05-05 06:28:19 -06:00

Author

Owner

@ghost commented on GitHub (Apr 24, 2021):

@fenuks You're welcome. Firejail is very picky on these things.

@rusty-snake I'm closing this for now. This stuff is old and known quirks are documented. Anyone still encountering this can reopen.

@ghost commented on GitHub (Apr 24, 2021): @fenuks You're welcome. Firejail is very picky on these things. @rusty-snake I'm closing this for now. This stuff is old and known quirks are documented. Anyone still encountering this can reopen.

gitea-mirror referenced this issue

2026-05-05 10:06:39 -06:00

[PR #695] [MERGED] Busybox workaround + expand ${PATH} macro in noblacklist entries #3720

Rows
Columns

[GH-ISSUE #1018] Issue with --noblacklist having no effect #695