github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1238] default bind mounts and noexec option #841

New issue

Closed

opened 2026-05-05 06:57:28 -06:00 by gitea-mirror · 7 comments

gitea-mirror commented

2026-05-05 06:57:28 -06:00

Owner

Originally created by @SYN-cook on GitHub (Apr 21, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1238

noexec /tmp and noexec ${HOME} don't necessarily block execution completely, I see few folders still allowing it:

~/.config/pulse
/tmp/.X11-unix
~/.local/share

Since noexec options are being used in profiles, it would be nice to close loopholes for the standard configuration.

~/.local/share can be easily handled in disable-common.inc. And the .X11-unix and pulse folders should be also safe for remounting with a noexec flag.

Originally created by @SYN-cook on GitHub (Apr 21, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1238 `noexec /tmp` and `noexec ${HOME}` don't necessarily block execution completely, I see few folders still allowing it: - ~/.config/pulse - /tmp/.X11-unix - ~/.local/share Since noexec options are being used in profiles, it would be nice to close loopholes for the standard configuration. ~/.local/share can be easily handled in disable-common.inc. And the .X11-unix and pulse folders should be also safe for remounting with a noexec flag.

gitea-mirror

2026-05-05 06:57:28 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 06:57:32 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Apr 21, 2017):

Why does 'noexec ${HOME}' not apply to ~/.local/share? Also this will break a few profiles such as Steam, which stores itself there.

@SkewedZeppelin commented on GitHub (Apr 21, 2017): Why does 'noexec ${HOME}' not apply to ~/.local/share? Also this will break a few profiles such as Steam, which stores itself there.

gitea-mirror commented

2026-05-05 06:57:35 -06:00

Author

Owner

@SYN-cook commented on GitHub (Apr 21, 2017):

@SpotComms Did you try running e.g. findmnt inside the jail? It would be interesting if you can't reproduce it, I have seen it on different systems.

If besides Steam more programs install themselves to ~/.local/share, maybe an alternative implementation could be to tie all remounting works to the noexec options, instead of remounting the folders noexec from the beginning.

@SYN-cook commented on GitHub (Apr 21, 2017): @SpotComms Did you try running e.g. `findmnt` inside the jail? It would be interesting if you can't reproduce it, I have seen it on different systems. If besides Steam more programs install themselves to ~/.local/_share_, maybe an alternative implementation could be to tie all remounting works to the noexec options, instead of remounting the folders noexec from the beginning.

gitea-mirror commented

2026-05-05 06:57:39 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Apr 21, 2017):

You are correct, I was just wondering why 'noexec ${HOME}' doesn't apply recursively as I assumed it did.

~~Edit: noexec just does the one directory specified, none of the other directories end up with noexec. That seems pretty useless. @netblue30 please make noexec recursively apply.~~

@SkewedZeppelin commented on GitHub (Apr 21, 2017): You are correct, I was just wondering why 'noexec ${HOME}' doesn't apply recursively as I assumed it did. ~~Edit: noexec just does the one directory specified, none of the other directories end up with noexec. That seems pretty useless. @netblue30 please make noexec recursively apply.~~

gitea-mirror commented

2026-05-05 06:57:42 -06:00

Author

Owner

@SYN-cook commented on GitHub (Apr 21, 2017):

@SpotComms On my current setup (I'm on a trip and unfortunately can't try many things), the noexec option is enforced recursively, except for those three folders mentioned in the first comment.... e.g. I go to a random subfolder and try to run an executable, I am told I don't have permissions to do so.

Is it possible for you to execute programs/scripts in subfolders?

@SYN-cook commented on GitHub (Apr 21, 2017): @SpotComms On my current setup (I'm on a trip and unfortunately can't try many things), the noexec option is enforced recursively, except for those three folders mentioned in the first comment.... e.g. I go to a random subfolder and try to run an executable, I am told I don't have permissions to do so. Is it possible for you to execute programs/scripts in subfolders?

gitea-mirror commented

2026-05-05 06:57:45 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Apr 21, 2017):

@SYN-cook Okay so while 'findmnt' only shows the 'noexec' option for /home/user and not for any subdirectories, I cannot execute under ~, ~/.config. I can however execute under ~/.local/share. So yes you are again correct. I created #1242 as an alternative solution.

@SkewedZeppelin commented on GitHub (Apr 21, 2017): @SYN-cook Okay so while 'findmnt' only shows the 'noexec' option for /home/user and not for any subdirectories, I cannot execute under ~, ~/.config. I can however execute under ~/.local/share. So yes you are again correct. I created #1242 as an alternative solution.

gitea-mirror commented

2026-05-05 06:57:47 -06:00

Author

Owner

@SYN-cook commented on GitHub (Apr 21, 2017):

👍 Cool! So let's see what netblue30 says

@SYN-cook commented on GitHub (Apr 21, 2017): :+1: Cool! So let's see what netblue30 says

gitea-mirror commented

2026-05-05 06:57:51 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 22, 2017):

I'll play a little bit with noexec on ~/.config/pulse and /tmp/.X11-unix and put them disable-common.inc.

@netblue30 commented on GitHub (Apr 22, 2017): I'll play a little bit with noexec on ~/.config/pulse and /tmp/.X11-unix and put them disable-common.inc.

gitea-mirror referenced this issue

2026-05-05 08:52:58 -06:00

[GH-ISSUE #3501] noroot in Kodi's profile causing black/frozen screen #2202

gitea-mirror referenced this issue

2026-05-05 08:58:54 -06:00

[GH-ISSUE #3644] nvidia: opengl errors with nvidia proprietary driver due to "nogroups" #2294

gitea-mirror referenced this issue

2026-05-05 09:22:55 -06:00

[GH-ISSUE #4603] Feature Request: Logind conditional #2718

gitea-mirror referenced this issue

2026-05-05 09:51:52 -06:00

[GH-ISSUE #6372] Nvidia driver 550.90.07 needs access to /sys/module/nvidia* #3253