github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1235] Using both noblacklist and read-only on the same folder #839

New issue

Closed

opened 2026-05-05 06:57:11 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 06:57:11 -06:00

Owner

Originally created by @laniakea64 on GitHub (Apr 19, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1235

I had always thought that noblacklist ~/Documents simply prevented any blacklist directives from applying to ~/Documents. Nothing more, nothing less. But that can't be quite accurate, because noblacklist seems to prevent read-only from taking effect.

To see what I mean -

Create ~/Documents/sdfsdf.profile -

noblacklist ~/Documents
noblacklist ~/.config
noblacklist ~/.cache
noblacklist ~/.bashrc
blacklist ${HOME}/*
read-only ~/Documents

Run firejail with that profile -

firejail --profile=~/Documents/sdfsdf.profile

In the sandbox, run these commands

cd ~/Documents
touch Foo

... and there appears a file named Foo in ~/Documents.

Commenting out the lines noblacklist ~/Documents and blacklist ${HOME}/* in the profile, results in the touch command giving the expected "Read-only file system" error.

So what does noblacklist do exactly, and why does it seem to disable read-only?

Thanks for any insight.

Originally created by @laniakea64 on GitHub (Apr 19, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1235 I had always thought that `noblacklist ~/Documents` simply prevented any `blacklist` directives from applying to `~/Documents`. Nothing more, nothing less. But that can't be quite accurate, because `noblacklist` seems to prevent `read-only` from taking effect. To see what I mean - 1) Create `~/Documents/sdfsdf.profile` - ``` noblacklist ~/Documents noblacklist ~/.config noblacklist ~/.cache noblacklist ~/.bashrc blacklist ${HOME}/* read-only ~/Documents ``` 2) Run firejail with that profile - ``` firejail --profile=~/Documents/sdfsdf.profile ``` 3) In the sandbox, run these commands ``` cd ~/Documents touch Foo ``` ... and there appears a file named `Foo` in `~/Documents`. Commenting out the lines `noblacklist ~/Documents` and `blacklist ${HOME}/*` in the profile, results in the touch command giving the expected "Read-only file system" error. So what does `noblacklist` do exactly, and why does it seem to disable `read-only`? Thanks for any insight.

gitea-mirror

2026-05-05 06:57:11 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 06:57:15 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 30, 2018):

Seems to be fixed in the latest version, so I'll close the bug. @laniakea64, please re-open if you still have this issue.

[Edit] Never mind, I seem to be having the same issue.

@chiraag-nataraj commented on GitHub (Jul 30, 2018): Seems to be fixed in the latest version, so I'll close the bug. @laniakea64, please re-open if you still have this issue. [Edit] Never mind, I seem to be having the same issue.

gitea-mirror commented

2026-05-05 06:57:17 -06:00

Author

Owner

@matu3ba commented on GitHub (Jun 22, 2019):

@chiraag-nataraj What did you want to run on that profile? Another shell?
I am not sure, if using the same folder as the profile is the best example (since profiles should be in .config/firejail).
Check #2735 and #1569.
If I am not mistaken, your blacklist overwrites the noblacklist from before resulting in no access besides the HOME and seeing folder structure below.

@matu3ba commented on GitHub (Jun 22, 2019): @chiraag-nataraj What did you want to run on that profile? Another shell? I am not sure, if using the same folder as the profile is the best example (since profiles should be in `.config/firejail`). Check #2735 and #1569. If I am not mistaken, your blacklist overwrites the noblacklist from before resulting in no access besides the HOME and seeing folder structure below.

gitea-mirror commented

2026-05-05 06:57:18 -06:00

Author

Owner

@laniakea64 commented on GitHub (Jun 22, 2019):

(@matu3ba although I'm not @chiraag-nataraj , I am the original reporter and the author of the profile in the original description, so I'll reply to your comment anyway.)

What did you want to run on that profile?

Memory is a bit fuzzy now but I believe it stemmed from a generic attempt to work around https://github.com/netblue30/firejail/issues/1234 (now fixed).

I am not sure, if using the same folder as the profile is the best example (since profiles should be in .config/firejail).

Location of the profile file is immaterial. Same issue occurs on latest firejail with putting the profile in ~/.config/firejail.

If I am not mistaken, your blacklist overwrites the noblacklist from before resulting in no access besides the HOME and seeing folder structure below.

It doesn't for me, and I don't see how that's relevant? To be clear, the issue here is that noblacklist is overriding both blacklist and read-only, but it is only supposed to override blacklist.

@laniakea64 commented on GitHub (Jun 22, 2019): (@matu3ba although I'm not @chiraag-nataraj , I am the original reporter and the author of the profile in the original description, so I'll reply to your comment anyway.) > What did you want to run on that profile? Memory is a bit fuzzy now but I believe it stemmed from a generic attempt to work around https://github.com/netblue30/firejail/issues/1234 (now fixed). > I am not sure, if using the same folder as the profile is the best example (since profiles should be in `.config/firejail`). Location of the profile file is immaterial. Same issue occurs on latest firejail with putting the profile in `~/.config/firejail`. > If I am not mistaken, your blacklist overwrites the noblacklist from before resulting in no access besides the HOME and seeing folder structure below. It doesn't for me, and I don't see how that's relevant? To be clear, the issue here is that `noblacklist` is overriding **both** `blacklist` **and** `read-only`, but it is only supposed to override `blacklist`.

gitea-mirror commented

2026-05-05 06:57:20 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 22, 2019):

Works (but should not work):firejail --noblacklist="~/Bilder" --read-only="~/Bilder" touch Bilder/test2

@rusty-snake commented on GitHub (Jun 22, 2019): Works (but should not work):`firejail --noblacklist="~/Bilder" --read-only="~/Bilder" touch Bilder/test2`

gitea-mirror commented

2026-05-05 06:57:23 -06:00

Author

Owner

@smitsohu commented on GitHub (Jun 29, 2019):

Thanks! It should work now, you can give it a try.

@smitsohu commented on GitHub (Jun 29, 2019): Thanks! It should work now, you can give it a try.

gitea-mirror commented

2026-05-05 06:57:25 -06:00

Author

Owner

@laniakea64 commented on GitHub (Jun 29, 2019):

It does work now. Thanks @smitsohu for fixing this!

@laniakea64 commented on GitHub (Jun 29, 2019): It does work now. Thanks @smitsohu for fixing this!

gitea-mirror referenced this issue

2026-05-05 07:56:51 -06:00

[GH-ISSUE #2029] Possible conflict with noexec and whitelist #1367

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#839

No description provided.

Rows
Columns