[GH-ISSUE #1353] Whitelist not working?

gitea-mirror commented

2026-05-05 07:10:49 -06:00

Owner

Originally created by @rieje on GitHub (Jun 27, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1353

I run firefox in firejail sandbox and when I play videos using mpv from it, it's not using my mpv config. So I guess I have to whitelist my mpv config files. I have the ~/.config/mpv folder but in it contains all my configs that are symlinked from my git repo, so this may be the problem.

In my firefox.profile, I have:

noblacklist ~/.config/mpv

Is this not enough?

Originally created by @rieje on GitHub (Jun 27, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1353 I run firefox in firejail sandbox and when I play videos using mpv from it, it's not using my mpv config. So I guess I have to whitelist my mpv config files. I have the `~/.config/mpv` folder but in it contains all my configs that are symlinked from my git repo, so this may be the problem. In my firefox.profile, I have: noblacklist ~/.config/mpv Is this not enough?

gitea-mirror

2026-05-05 07:10:49 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 07:10:55 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 28, 2017):

You would also add a whitelist in your firefox.profile for mpv config:

whitelist ~/.config/mpv

but in it contains all my configs that are symlinked from my git repo

It shouldn't be a problem.

@netblue30 commented on GitHub (Jun 28, 2017): You would also add a whitelist in your firefox.profile for mpv config: ````` whitelist ~/.config/mpv ````` > but in it contains all my configs that are symlinked from my git repo It shouldn't be a problem.

gitea-mirror commented

2026-05-05 07:10:56 -06:00

Author

Owner

@rieje commented on GitHub (Jul 2, 2017):

@netblue30 It doesn't appear to be working--when I download a video and run it from Firefox, it's using default mpv settings instead of my customized ones. To be clear, here's what my config structure looks like. ~/.config/mpv is an actual folder, while all the config files inside are symlinked to under that folder, as you can see.

In my ~/.config/firejail/firefox.profile I have the following (my attempted settings are in the 2 blocks of text from the start of the config). It's probably excessive, but I wasn't sure if recursion is applied for a directory and whatnot.

Let me know what other information may be needed.

@rieje commented on GitHub (Jul 2, 2017): @netblue30 It doesn't appear to be working--when I download a video and run it from Firefox, it's using default mpv settings instead of my customized ones. To be clear, here's what my config structure [looks like](https://ptpb.pw/ACh-CZr_60X1o9tP1BjiR6KTR0Ny.png). `~/.config/mpv` is an actual folder, while all the config files inside are symlinked to under that folder, as you can see. In my `~/.config/firejail/firefox.profile` I have the [following](https://ptpb.pw/AA4bZBd4Sj9ktuAeoOvUmZvqLnae.profile) (my attempted settings are in the 2 blocks of text from the start of the config). It's probably excessive, but I wasn't sure if recursion is applied for a directory and whatnot. Let me know what other information may be needed.

gitea-mirror commented

2026-05-05 07:10:57 -06:00

Author

Owner

@liloman commented on GitHub (Jul 16, 2017):

Hi rieje,

I can't see your images but I hope it helps you.

I've just fixed a similar very long standing issue with my .mplayer/ dir. I don't use mpv but a custom Bash script that uses youtube-dl but I think It's related. ;)

The issue was:

I need the .mplayer/ folder be accessible from firefox (it's really a symlink to ~/dotfiles/mplayer/.mplayer in my settings but firejail whitelistes the target dir automatically)
I enabled it with:
whitelist ~/.mplayer
read-only ~/.mplayer
But I couldn't get to the target dir and when I launched mplayer from firefox It couldn't parse the config files and It was really annoying cause I disable the screensaver while playing from my mplayer config among other things.

What I did:

Launching a ls from vimperator console I realized that:
!ls ~/dotfiles/mplayer permissions were:
/home/user/dotfiles/mplayer:
total 4
dr---------. 2 nfsnobody nfsnobody 4096 mar 5 19:15 .mplayer
I fixed then with:
noblacklist ~/.mplayer
Now:
!ls ~/dotfiles/mplayer permissions are:
/home/user/dotfiles/mplayer:
total 4
drwxrwxr-x. 2 user user 4096 mar 5 19:15 .mplayer

Cheers

@liloman commented on GitHub (Jul 16, 2017): Hi rieje, I can't see your images but I hope it helps you. I've just fixed a similar very long standing issue with my .mplayer/ dir. I don't use mpv [but a custom Bash script that uses youtube-dl](https://github.com/liloman/dotfiles/blob/master/Scripts/Scripts/descarga.sh) but I think It's related. ;) The issue was: 1. I need the .mplayer/ folder be accessible from firefox (it's really a symlink to ~/dotfiles/mplayer/.mplayer in my settings but firejail whitelistes the target dir automatically) 2. I enabled it with: whitelist ~/.mplayer read-only ~/.mplayer 3. But I couldn't get to the target dir and when I launched mplayer from firefox It couldn't parse the config files and It was really annoying cause I disable the screensaver while playing from my mplayer config among other things. What I did: 1. Launching a ls from vimperator console I realized that: !ls ~/dotfiles/mplayer permissions were: /home/user/dotfiles/mplayer: total 4 dr---------. 2 nfsnobody nfsnobody 4096 mar 5 19:15 .mplayer 2. I fixed then with: noblacklist ~/.mplayer 3. Now: !ls ~/dotfiles/mplayer permissions are: /home/user/dotfiles/mplayer: total 4 drwxrwxr-x. 2 user user 4096 mar 5 19:15 .mplayer Cheers

gitea-mirror commented

2026-05-05 07:10:58 -06:00

Author

Owner

@rieje commented on GitHub (Jul 24, 2017):

@liloman Thanks for the detailed response. Do you use --private or --private <dir> for your firefox profile? In my particular scenario I'm using --private <dir> for my Firefox profile and when I launch firejail, I get Warning: "whitelist ~/.config/mpv" disabled by --private so maybe --private <dir> is not supported by firejail for some reason.

To be clear, my ~/.config/mpv symlink structure looks like this:

$ ls ~/.config/mpv
drwx------ 1 rieje rieje ?  64 May 22 09:36 watch_later
lrwxrwxrwx 1 rieje rieje ?  45 May 23 22:17 lua-settings -> ../../.dotfiles/arch/.config/mpv/lua-settings
lrwxrwxrwx 1 rieje rieje ?  40 May 23 22:17 scripts -> ../../.dotfiles/arch/.config/mpv/scripts
lrwxrwxrwx 1 rieje rieje ?  43 Apr 25 01:25 input.conf -> ../../.dotfiles/arch/.config/mpv/input.conf
lrwxrwxrwx 1 rieje rieje ?  41 Mar 10 12:37 mpv.conf -> ../../.dotfiles/vega/.config/mpv/mpv.conf

, which according to what I've read it doesn't matter because firejail should follow the symlinks appropriately. In my firefox.profile I have the following:

whitelist ~/.config/mpv
read-only ~/.config/mpv
noblacklist ~/.config/mpv

@rieje commented on GitHub (Jul 24, 2017): @liloman Thanks for the detailed response. Do you use `--private` or `--private <dir>` for your firefox profile? In my particular scenario I'm using `--private <dir>` for my Firefox profile and when I launch firejail, I get `Warning: "whitelist ~/.config/mpv" disabled by --private` so maybe `--private <dir>` is not supported by firejail for some reason. To be clear, my `~/.config/mpv` symlink structure looks like this: $ ls ~/.config/mpv drwx------ 1 rieje rieje ? 64 May 22 09:36 watch_later lrwxrwxrwx 1 rieje rieje ? 45 May 23 22:17 lua-settings -> ../../.dotfiles/arch/.config/mpv/lua-settings lrwxrwxrwx 1 rieje rieje ? 40 May 23 22:17 scripts -> ../../.dotfiles/arch/.config/mpv/scripts lrwxrwxrwx 1 rieje rieje ? 43 Apr 25 01:25 input.conf -> ../../.dotfiles/arch/.config/mpv/input.conf lrwxrwxrwx 1 rieje rieje ? 41 Mar 10 12:37 mpv.conf -> ../../.dotfiles/vega/.config/mpv/mpv.conf , which according to what I've read it doesn't matter because firejail should follow the symlinks appropriately. In my firefox.profile I have the following: whitelist ~/.config/mpv read-only ~/.config/mpv noblacklist ~/.config/mpv

gitea-mirror commented

2026-05-05 07:11:00 -06:00

Author

Owner

@liloman commented on GitHub (Jul 25, 2017):

No, I don't. I'm using this:

firejail --name=firefox firefox -P default

Maybe with:

firejail --debug firefox

you could get help.

Anyway for this kind of issues you can debug with 3 methods:

Using file:///home in the browser and seeing what looks like.
If you are using vimperator/X you can spawn a terminal inside the firejailed firefox with:
:!youterminal-name
I think you can also join a terminal inside a firefjail process with --join. :)

See if your files are there, obviously they aren't, and see what it really looks like and find out why. I will test with different scenarios from the more basic to the more restricted, kind git bisect. ;)

Cheers

@liloman commented on GitHub (Jul 25, 2017): No, I don't. I'm using this: ```bash firejail --name=firefox firefox -P default ``` Maybe with: ```bash firejail --debug firefox ``` you could get help. Anyway for this kind of issues you can debug with 3 methods: 1. Using file:///home in the browser and seeing what looks like. 2. If you are using vimperator/X you can spawn a terminal inside the firejailed firefox with: :!youterminal-name 3. I think you can also join a terminal inside a firefjail process with --join. :) See if your files are there, obviously they aren't, and see what it really looks like and find out why. I will test with different scenarios from the more basic to the more restricted, kind git bisect. ;) Cheers

gitea-mirror commented

2026-05-05 07:11:02 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Sep 30, 2018):

@rieje Is this still an issue?

@chiraag-nataraj commented on GitHub (Sep 30, 2018): @rieje Is this still an issue?

gitea-mirror commented

2026-05-05 07:11:04 -06:00

Author

Owner

@rieje commented on GitHub (Oct 2, 2018):

Unfortunately yes. I am using the latest version of firejail and removed any custom profile settings. Here's the contents of /etc/firejail/firefox.profile, the only file I've touched. The only custom settings are:

noblacklist ~/.config/mpv
whitelist ~/.config/mpv
read-only ~/.config/mpv

I use firejail like so: firejail --seccomp --private=<path> /usr/bin/firefox -no-remote. Can anyone reproduce?

@rieje commented on GitHub (Oct 2, 2018): Unfortunately yes. I am using the latest version of firejail and removed any custom profile settings. [Here's](https://ptpb.pw/AA2A5It1oEw_UHl_UC52W3NsAmsl.profile) the contents of `/etc/firejail/firefox.profile`, the only file I've touched. The only custom settings are: noblacklist ~/.config/mpv whitelist ~/.config/mpv read-only ~/.config/mpv I use firejail like so: `firejail --seccomp --private=<path> /usr/bin/firefox -no-remote`. Can anyone reproduce?

gitea-mirror commented

2026-05-05 07:11:06 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 26, 2019):

@rieje can you do what @liloman say to look if the files are there?

@rusty-snake commented on GitHub (Jun 26, 2019): @rieje can you do what @liloman say to look if the files are there?

gitea-mirror commented

2026-05-05 07:11:07 -06:00

Author

Owner

@rieje commented on GitHub (Jun 26, 2019):

@rusty-snake They are not there. On Arch Linux, firejail version 0.9.60. My firefox.profile.

@rieje commented on GitHub (Jun 26, 2019): @rusty-snake They are not there. On Arch Linux, firejail version 0.9.60. My [firefox.profile](https://pastebin.com/GyAA59vK).

gitea-mirror commented

2026-05-05 07:11:08 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 27, 2019):

@rahiel confirming that --private + --whitelist didn't work (as it should), but why do you use --private.

@rusty-snake commented on GitHub (Jun 27, 2019): @rahiel confirming that `--private` + `--whitelist` didn't work (as it should), but why do you use `--private`.

gitea-mirror commented

2026-05-05 07:11:09 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 7, 2020):

I'm closing here due to inactivity, please fell free to reopen if you still have this issue.

@rusty-snake commented on GitHub (Jun 7, 2020): I'm closing here due to inactivity, please fell free to reopen if you still have this issue.

Rows
Columns

[GH-ISSUE #1353] Whitelist not working? #932