github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1250] Question regarding whitelisting a specific file inside a blacklisted directory. #855

New issue

Closed

opened 2026-05-05 06:58:51 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 06:58:51 -06:00

Owner

Originally created by @ghost on GitHub (Apr 27, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1250

Is there any way I can specifically whitelist a file inside a blacklisted directory ?
Like for example say I have folder A and file B.
When a program is launched it creates folder A and a bunch of stuff inside it along side B.
Is it possible to make it so that the program can only write, modify and read only the B file and nothing else inside A ?

Originally created by @ghost on GitHub (Apr 27, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1250 Is there any way I can specifically whitelist a file inside a blacklisted directory ? Like for example say I have folder A and file B. When a program is launched it creates folder A and a bunch of stuff inside it along side B. Is it possible to make it so that the program can only write, modify and read only the B file and nothing else inside A ?

gitea-mirror closed this issue

2026-05-05 06:58:53 -06:00

gitea-mirror commented

2026-05-05 06:58:57 -06:00

Author

Owner

@SYN-cook commented on GitHub (Apr 27, 2017):

What you could try in a profile:

Ensure A and B exist:

mkdir A
mkfile A/B

Don't allow anything new in A:

read-only A
read-write A/B

If A is not empty from a previous run, blacklist everything except B:

noblacklist A/B
blacklist A/*

EDIT: or if you prefer to whitelist, replace the last code block with whitelist A/B

The question is if your program still runs then.

@SYN-cook commented on GitHub (Apr 27, 2017): What you could try in a profile: 1. Ensure A and B exist: ``` mkdir A mkfile A/B ``` 2. Don't allow anything new in A: ``` read-only A read-write A/B ``` 3. If A is not empty from a previous run, blacklist everything except B: ``` noblacklist A/B blacklist A/* ``` EDIT: or if you prefer to whitelist, replace the last code block with `whitelist A/B` The question is if your program still runs then.

gitea-mirror commented

2026-05-05 06:58:59 -06:00

Author

Owner

@ghost commented on GitHub (Apr 29, 2017):

It doesn't seem to run but I got the gist of your thought process. I'll make it work.

@ghost commented on GitHub (Apr 29, 2017): It doesn't seem to run but I got the gist of your thought process. I'll make it work.

gitea-mirror commented

2026-05-05 06:59:01 -06:00

Author

Owner

@ghost commented on GitHub (Jun 13, 2017):

How would I go about this if the programs insists on creating the file itself. ?

@ghost commented on GitHub (Jun 13, 2017): How would I go about this if the programs insists on creating the file itself. ?

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#855

No description provided.

Rows
Columns