[GH-ISSUE #119] Private /tmp #77

New issue

Closed

opened 2026-05-05 04:59:29 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 04:59:29 -06:00

Owner

Originally created by @xmikos on GitHub (Nov 6, 2015).
Original GitHub issue: https://github.com/netblue30/firejail/issues/119

It would be great if you can add --private-tmp option (to make /tmp private). There could be many information leaks and sensitive files in /tmp (like /tmp/xauth* files, unix sockets for many apps running outside of sandbox, etc.).

It would also need option to make some files/directories in /tmp shared with host (bind-mounted). Btw. is there similar option for --private (shared directory inside $HOME using bind-mount)? I didn't find it, --private-home=something seems to only copy files/directories inside private home. And --bind=src,dst isn't useful because it needs root.

Originally created by @xmikos on GitHub (Nov 6, 2015). Original GitHub issue: https://github.com/netblue30/firejail/issues/119 It would be great if you can add `--private-tmp` option (to make `/tmp` private). There could be many information leaks and sensitive files in /tmp (like /tmp/xauth\* files, unix sockets for many apps running outside of sandbox, etc.). It would also need option to make some files/directories in /tmp shared with host (bind-mounted). Btw. is there similar option for `--private` (shared directory inside $HOME using bind-mount)? I didn't find it, `--private-home=something` seems to only copy files/directories inside private home. And `--bind=src,dst` isn't useful because it needs root.

gitea-mirror

2026-05-05 04:59:29 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 04:59:37 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 12, 2015):

All done.

Mount an empty, temporary filesystem on top of /tmp:

$ firejail --tmpfs=/tmp
Reading profile /etc/firejail/generic.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc

** Note: you can use --noprofile to disable generic.profile **

Parent pid 18390, child pid 18391
Child process initialized
$ ls -l /tmp
total 0

Whitelist support for /tmp directory (similar to home directory whitelisting):

$ firejail --whitelist=/tmp/.ICE-unix --whitelist=/tmp/pulse-PKdhtXMmr18
Reading profile /etc/firejail/generic.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc

** Note: you can use --noprofile to disable generic.profile **

Parent pid 18407, child pid 18408
Child process initialized
]$ ls -al /tmp
total 12
drwxrwxrwx  4 nobody nogroup   80 Nov 12 08:50 .
drwxr-xr-x 26 nobody nogroup 4096 Oct 31 10:30 ..
drwxrwxrwt  2 nobody nogroup 4096 Nov 11 16:01 .ICE-unix
drwx------  2 nobody nogroup 4096 Nov 11 16:01 pulse-PKdhtXMmr18n

You can add as many --whitelist commands as you need, you can also mix them with home directory whitelists (--whitelist=~/.mozilla).

I intend to add support for whitelisting /etc and /dev. If you need anything else, let me know.

@netblue30 commented on GitHub (Nov 12, 2015): All done. Mount an empty, temporary filesystem on top of /tmp: ``` $ firejail --tmpfs=/tmp Reading profile /etc/firejail/generic.profile Reading profile /etc/firejail/disable-mgmt.inc Reading profile /etc/firejail/disable-secret.inc Reading profile /etc/firejail/disable-common.inc ** Note: you can use --noprofile to disable generic.profile ** Parent pid 18390, child pid 18391 Child process initialized $ ls -l /tmp total 0 ``` Whitelist support for /tmp directory (similar to home directory whitelisting): ``` $ firejail --whitelist=/tmp/.ICE-unix --whitelist=/tmp/pulse-PKdhtXMmr18 Reading profile /etc/firejail/generic.profile Reading profile /etc/firejail/disable-mgmt.inc Reading profile /etc/firejail/disable-secret.inc Reading profile /etc/firejail/disable-common.inc ** Note: you can use --noprofile to disable generic.profile ** Parent pid 18407, child pid 18408 Child process initialized ]$ ls -al /tmp total 12 drwxrwxrwx 4 nobody nogroup 80 Nov 12 08:50 . drwxr-xr-x 26 nobody nogroup 4096 Oct 31 10:30 .. drwxrwxrwt 2 nobody nogroup 4096 Nov 11 16:01 .ICE-unix drwx------ 2 nobody nogroup 4096 Nov 11 16:01 pulse-PKdhtXMmr18n ``` You can add as many --whitelist commands as you need, you can also mix them with home directory whitelists (--whitelist=~/.mozilla). I intend to add support for whitelisting /etc and /dev. If you need anything else, let me know.

gitea-mirror referenced this issue

2026-05-05 10:03:11 -06:00

[PR #77] [MERGED] use configure options in Makefile #3532

gitea-mirror referenced this issue

2026-05-05 10:03:11 -06:00

[PR #78] [CLOSED] standalone rpm spec #3533