github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #121] Can't whitelist subdirectories #80

New issue

Closed

opened 2026-05-05 04:59:46 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 04:59:46 -06:00

Owner

Originally created by @ghost on GitHub (Nov 6, 2015).
Original GitHub issue: https://github.com/netblue30/firejail/issues/121

I can't whitelist a subdirectory of a directory in my $HOME. That is, whitelisting ~/dir works, but ~/dir/subdir doesn't work. There is no error/warning on firejail invocation, but upon trying to enter the subdirectory, permission is denied.
If I try to also whitelist the parent directory, I get "Error mkdir:whitelist_path(99): File exists". Whitelisting the parent directory only, works.

I discovered this while wanting to whitelist ~/.config/deadbeef and deadbeef curiously failed to start, but started correctly when not whitelisted.

My version is 0.9.32

Example:

mkdir -p ~/test/1 ~/test/2
firejail --whitelist=~/test/1
cd ~/test/1
cd ~/test/

Originally created by @ghost on GitHub (Nov 6, 2015). Original GitHub issue: https://github.com/netblue30/firejail/issues/121 I can't whitelist a subdirectory of a directory in my $HOME. That is, whitelisting ~/dir works, but ~/dir/subdir doesn't work. There is no error/warning on firejail invocation, but upon trying to enter the subdirectory, permission is denied. If I try to also whitelist the parent directory, I get "Error mkdir:whitelist_path(99): File exists". Whitelisting the parent directory only, works. I discovered this while wanting to whitelist ~/.config/deadbeef and deadbeef curiously failed to start, but started correctly when not whitelisted. My version is 0.9.32 Example: ``` mkdir -p ~/test/1 ~/test/2 firejail --whitelist=~/test/1 cd ~/test/1 cd ~/test/ ```

gitea-mirror

2026-05-05 04:59:46 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 04:59:52 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 9, 2015):

I would suggest you move to version 0.9.34, it has quite a number of fixes. This is how I start deadbeef on my machine:

$ firejail /opt/deadbeef-0.6.2/deadbeef

It also works with whitelisting:

$ firejail --whitelist=~/.config/deadbeef /opt/deadbeef-0.6.2/deadbeef

@netblue30 commented on GitHub (Nov 9, 2015): I would suggest you move to version 0.9.34, it has quite a number of fixes. This is how I start deadbeef on my machine: ``` $ firejail /opt/deadbeef-0.6.2/deadbeef ``` It also works with whitelisting: ``` $ firejail --whitelist=~/.config/deadbeef /opt/deadbeef-0.6.2/deadbeef ```

gitea-mirror commented

2026-05-05 04:59:55 -06:00

Author

Owner

@ghost commented on GitHub (Nov 10, 2015):

Sorry I take so long, I was very busy. I'll test it soon, but I believe you when you say it is fixed.

@ghost commented on GitHub (Nov 10, 2015): Sorry I take so long, I was very busy. I'll test it soon, but I believe you when you say it is fixed.

gitea-mirror commented

2026-05-05 04:59:58 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 10, 2015):

No problem, give it a try and let me know.

@netblue30 commented on GitHub (Nov 10, 2015): No problem, give it a try and let me know.

gitea-mirror commented

2026-05-05 04:59:59 -06:00

Author

Owner

@ghost commented on GitHub (Nov 11, 2015):

Just updated to 0.9.34
For some reason it still doesn't work.
I get this:

$ firejail --whitelist=.config/deadbeef/ deadbeef
Reading profile /etc/firejail/deadbeef.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Parent pid 19653, child pid 19654
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Child process initialized
starting deadbeef 0.6.2
server_start
INFO: unlink socket: Permission denied
bind: Permission denied

parent is shutting down, bye...

I tried some variations of the whitelist path, namely

${HOME}/.config/deadbeef/
~/.config/deadbeef/
./.config/deadbeef/
.config/deadbeef/
.config/deadbeef

and it all yielded the same result.

Again, when trying to cd into .config/, I get Permission denied. Whitelisting .config/ only, works.

Edit: Added debug.log
debug_log.txt

@ghost commented on GitHub (Nov 11, 2015): Just updated to 0.9.34 For some reason it still doesn't work. I get this: ``` $ firejail --whitelist=.config/deadbeef/ deadbeef Reading profile /etc/firejail/deadbeef.profile Reading profile /etc/firejail/disable-mgmt.inc Reading profile /etc/firejail/disable-secret.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Parent pid 19653, child pid 19654 Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Child process initialized starting deadbeef 0.6.2 server_start INFO: unlink socket: Permission denied bind: Permission denied parent is shutting down, bye... ``` I tried some variations of the whitelist path, namely ``` ${HOME}/.config/deadbeef/ ~/.config/deadbeef/ ./.config/deadbeef/ .config/deadbeef/ .config/deadbeef ``` and it all yielded the same result. Again, when trying to cd into .config/, I get Permission denied. Whitelisting .config/ only, works. Edit: Added debug.log [debug_log.txt](https://github.com/netblue30/firejail/files/32237/debug_log.txt)

gitea-mirror commented

2026-05-05 05:00:01 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 12, 2015):

You need a full path in --whitelist. Instead of "--whitelist=.config/deadbeef/", put "--whitelist=~/.config/deadbeef/"

@netblue30 commented on GitHub (Nov 12, 2015): You need a full path in --whitelist. Instead of "--whitelist=.config/deadbeef/", put "--whitelist=~/.config/deadbeef/"

gitea-mirror commented

2026-05-05 05:00:03 -06:00

Author

Owner

@ghost commented on GitHub (Nov 12, 2015):

Yeah that's what I tried. They're all equivalent.
Anyway, I'll try fixing it myself. Not sure why it is a problem for me but seemingly no one else, but alright.

@ghost commented on GitHub (Nov 12, 2015): Yeah that's what I tried. They're all equivalent. Anyway, I'll try fixing it myself. Not sure why it is a problem for me but seemingly no one else, but alright.

gitea-mirror referenced this issue

2026-05-05 10:03:12 -06:00

[PR #79] [MERGED] switch project url to github #3535

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#80

No description provided.

Rows
Columns