github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #124] Thunderbird and OpenPGP #84

New issue

Closed

opened 2026-05-05 05:00:04 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 05:00:04 -06:00

Owner

Originally created by @0nse on GitHub (Nov 9, 2015).
Original GitHub issue: https://github.com/netblue30/firejail/issues/124

disable-secret.inc disables ${HOME}/.gnupg which is fine for most applications. However, I would whitelist the directory for Thunderbird because mailing is probably one of the most important usecases for GPG. Otherwise, Engimail won't find any keys to sign, encrypt, decrypt and verify signatures.

Originally created by @0nse on GitHub (Nov 9, 2015). Original GitHub issue: https://github.com/netblue30/firejail/issues/124 `disable-secret.inc` disables `${HOME}/.gnupg` which is fine for most applications. However, I would whitelist the directory for Thunderbird because mailing is probably one of the most important usecases for GPG. Otherwise, Engimail won't find any keys to sign, encrypt, decrypt and verify signatures.

gitea-mirror

2026-05-05 05:00:04 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 05:00:12 -06:00

Author

Owner

@nailarch commented on GitHub (Nov 9, 2015):

I had to add "whitelist ~/Загрузки" to firefox.profile to be able to save files to ~/Загрузки directory.
It's not a problem.
But what about priorities and differences between noblacklist and whitelist options ?
Or they are the same ?

@nailarch commented on GitHub (Nov 9, 2015): I had to add "whitelist ~/Загрузки" to firefox.profile to be able to save files to ~/Загрузки directory. It's not a problem. But what about priorities and differences between noblacklist and whitelist options ? Or they are the same ?

gitea-mirror commented

2026-05-05 05:00:15 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 9, 2015):

Fixed both Загрузки and .gnupg. Thanks!

Whitelist is applied first - it will mount a tmpfs on your home directory and bring in (mount-bind) only the directories whitelisted.

Then, blacklists are applied. noblacklist disables blacklist statements.

@netblue30 commented on GitHub (Nov 9, 2015): Fixed both Загрузки and .gnupg. Thanks! Whitelist is applied first - it will mount a tmpfs on your home directory and bring in (mount-bind) only the directories whitelisted. Then, blacklists are applied. noblacklist disables blacklist statements.

gitea-mirror commented

2026-05-05 05:00:17 -06:00

Author

Owner

@Micha-Btz commented on GitHub (Nov 16, 2015):

hm, for me it is not working. i have the release 0.9.34 from debian tree and added
noblacklist ${HOME}/.gnupg
to the thunderbird profile, but firejail disable it anyway.
Disable /home/mdomann/.gnupg
the strange thing is, if i whitelistet it my icedove profil folder is empty, it will create new profiles fpor mail and so on.

here the log
https://gist.github.com/Micha-Btz/e6dd8f5f277e91a277e7
the strange thing is, firejail checks at start 2 times for gnupg, but i see not why.

root@sysiphus:/etc/firejail# grep -r .gnupg .
./thunderbird.profile:noblacklist ${HOME}/.gnupg
./disable-secret.inc:blacklist ${HOME}/.gnupg

@Micha-Btz commented on GitHub (Nov 16, 2015): hm, for me it is not working. i have the release 0.9.34 from debian tree and added noblacklist ${HOME}/.gnupg to the thunderbird profile, but firejail disable it anyway. Disable /home/mdomann/.gnupg the strange thing is, if i whitelistet it my icedove profil folder is empty, it will create new profiles fpor mail and so on. here the log https://gist.github.com/Micha-Btz/e6dd8f5f277e91a277e7 the strange thing is, firejail checks at start 2 times for gnupg, but i see not why. root@sysiphus:/etc/firejail# grep -r .gnupg . ./thunderbird.profile:noblacklist ${HOME}/.gnupg ./disable-secret.inc:blacklist ${HOME}/.gnupg

gitea-mirror commented

2026-05-05 05:00:21 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 17, 2015):

You have to add "noblacklist" before "include":

# Firejail profile for Mozilla Thunderbird (Icedove in Debian)
noblacklist ${HOME}/.gnupg
include /etc/firejail/disable-mgmt.inc
include /etc/firejail/disable-secret.inc
include /etc/firejail/disable-devel.inc

This is how it works on the latest version in git:

$ firejail --profile=/etc/firejail/icedove.profile 
Reading profile /etc/firejail/icedove.profile
Reading profile /etc/firejail/thunderbird.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-devel.inc
Parent pid 29473, child pid 29474
Child process initialized
$ ls -l ~/.gnupg
total 36
-rw------- 1 netblue netblue 9188 Nov  5  2014 gpg.conf
-rw------- 1 netblue netblue 1203 Nov  5  2014 pubring.gpg
-rw------- 1 netblue netblue 1203 Nov  5  2014 pubring.gpg~
-rw------- 1 netblue netblue  600 Nov  8 10:06 random_seed
-rw-r--r-- 1 netblue netblue  938 Nov  5  2014 revocation
-rw------- 1 netblue netblue 2581 Nov  5  2014 secring.gpg
-rw------- 1 netblue netblue 1280 Nov  5  2014 trustdb.gpg
$

@netblue30 commented on GitHub (Nov 17, 2015): You have to add "noblacklist" before "include": ``` # Firejail profile for Mozilla Thunderbird (Icedove in Debian) noblacklist ${HOME}/.gnupg include /etc/firejail/disable-mgmt.inc include /etc/firejail/disable-secret.inc include /etc/firejail/disable-devel.inc ``` This is how it works on the latest version in git: ``` $ firejail --profile=/etc/firejail/icedove.profile Reading profile /etc/firejail/icedove.profile Reading profile /etc/firejail/thunderbird.profile Reading profile /etc/firejail/disable-mgmt.inc Reading profile /etc/firejail/disable-secret.inc Reading profile /etc/firejail/disable-devel.inc Parent pid 29473, child pid 29474 Child process initialized $ ls -l ~/.gnupg total 36 -rw------- 1 netblue netblue 9188 Nov 5 2014 gpg.conf -rw------- 1 netblue netblue 1203 Nov 5 2014 pubring.gpg -rw------- 1 netblue netblue 1203 Nov 5 2014 pubring.gpg~ -rw------- 1 netblue netblue 600 Nov 8 10:06 random_seed -rw-r--r-- 1 netblue netblue 938 Nov 5 2014 revocation -rw------- 1 netblue netblue 2581 Nov 5 2014 secring.gpg -rw------- 1 netblue netblue 1280 Nov 5 2014 trustdb.gpg $ ```

gitea-mirror commented

2026-05-05 05:00:22 -06:00

Author

Owner

@Micha-Btz commented on GitHub (Nov 17, 2015):

ok, this way it works. thanks

@Micha-Btz commented on GitHub (Nov 17, 2015): ok, this way it works. thanks

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#84

No description provided.

Rows
Columns