[GH-ISSUE #1388] 2 gotchas with whitelist (ending / and origin dir of a symlinked file)

gitea-mirror commented

2026-05-05 07:12:36 -06:00

Owner

Originally created by @liloman on GitHub (Jul 16, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1388

Hi,

Another round of problems solving: :)

If you type a dir with a ending / it doesn't work

whitelist ~/mydir/

I reckon It should work as usual.

When you whitelist symlinked files it doesn't whitelist the origin dir.

$mkdir test;  echo hiiiiii > test/myfile
$ln -s test/ test-sym
$ls test-sym/
myfile

And then in your profile:

whitelist test-sym/myfile

It properly whitelists:
test/
test/myfile

But it doesn't whitelist:
test-sym/

This scenario is my normal setting. :)

Cheers and greetings. :)

Originally created by @liloman on GitHub (Jul 16, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1388 Hi, Another round of problems solving: :) 1. If you type a dir with a ending / it doesn't work ```bash whitelist ~/mydir/ ``` I reckon It should work as usual. 2. When you whitelist symlinked files it doesn't whitelist the origin dir. ```bash $mkdir test; echo hiiiiii > test/myfile $ln -s test/ test-sym $ls test-sym/ myfile ``` And then in your profile: ```bash whitelist test-sym/myfile ``` It properly whitelists: test/ test/myfile But it doesn't whitelist: test-sym/ This scenario is my normal setting. :) Cheers and greetings. :)

gitea-mirror

2026-05-05 07:12:36 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 07:12:40 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Nov 8, 2017):

G'day @liloman !
1 works normally on my system. I haven't been able to test # 2 yet.
Since we've had the 0.9.50 release after your post, would it be possible for you to test this again and see if the problems remain?
Thanks!
Fred

@Fred-Barclay commented on GitHub (Nov 8, 2017): G'day @liloman ! 1 works normally on my system. I haven't been able to test # 2 yet. Since we've had the 0.9.50 release after your post, would it be possible for you to test this again and see if the problems remain? Thanks! Fred

gitea-mirror commented

2026-05-05 07:12:41 -06:00

Author

Owner

@liloman commented on GitHub (Nov 9, 2017):

➬firejail --version
firejail version 0.9.51

Compile time support:
- AppArmor support is disabled
- AppImage support is enabled
- bind support is enabled
- chroot support is enabled
- file and directory whitelisting support is enabled
- file transfer support is disabled
- git install support is disabled
- networking support is enabled
- overlayfs support is enabled
- private-home support is enabled
- seccomp-bpf support is enabled
- user namespace support is enabled
- X11 sandboxing support is disabled

I confirm that I still have the two issues.

I can't whitelist a dir ending with "/" and It doesn't whitelist the realpath of the symlink. :)

Cheers and thanks!!!

@liloman commented on GitHub (Nov 9, 2017): ➬firejail --version firejail version 0.9.51 Compile time support: - AppArmor support is disabled - AppImage support is enabled - bind support is enabled - chroot support is enabled - file and directory whitelisting support is enabled - file transfer support is disabled - git install support is disabled - networking support is enabled - overlayfs support is enabled - private-home support is enabled - seccomp-bpf support is enabled - user namespace support is enabled - X11 sandboxing support is disabled I confirm that I still have the two issues. I can't whitelist a dir ending with "/" and It doesn't whitelist the realpath of the symlink. :) Cheers and thanks!!!

gitea-mirror commented

2026-05-05 07:12:44 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Nov 10, 2017):

What distro is this?

@Fred-Barclay commented on GitHub (Nov 10, 2017): What distro is this?

gitea-mirror commented

2026-05-05 07:12:47 -06:00

Author

Owner

@liloman commented on GitHub (Nov 15, 2017):

Fedora 24.

@liloman commented on GitHub (Nov 15, 2017): Fedora 24.

gitea-mirror commented

2026-05-05 07:12:48 -06:00

Author

Owner

@curiosity-seeker commented on GitHub (Nov 16, 2017):

You know that Fedora 24 is EOL?

See https://fedoramagazine.org/fedora-24-eol/

@curiosity-seeker commented on GitHub (Nov 16, 2017): You know that Fedora 24 is EOL? See https://fedoramagazine.org/fedora-24-eol/

gitea-mirror commented

2026-05-05 07:12:49 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 20, 2018):

@liloman Is this still an issue?

@chiraag-nataraj commented on GitHub (Aug 20, 2018): @liloman Is this still an issue?

gitea-mirror commented

2026-05-05 07:12:50 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 22, 2018):

Closing for inactivity. @liloman, please feel free to re-open if you still have this issue.

@chiraag-nataraj commented on GitHub (Aug 22, 2018): Closing for inactivity. @liloman, please feel free to re-open if you still have this issue.

gitea-mirror commented

2026-05-05 07:12:52 -06:00

Author

Owner

@bircoph commented on GitHub (Oct 31, 2018):

I have issue №2 with firejail-0.9.56 on Gentoo:

I have some directories in $HOME an symlinks, e.g.:
.config -> .private/.config

And now whitelists and blacklists for files within .config doesn't work properly:
$ firejail --profile=/etc/firejail/firefox.profile bash:

$ ls -al .config
total 0
drwx------ 3 andrew andrew  60 Oct 31 23:52 .
drwx------ 7 andrew andrew 280 Oct 31 23:52 ..
drwx------ 2 andrew andrew  40 Oct 31 23:52 dconf
$ ls -al .private/.config
total 72
drwxr-xr-x  7 andrew andrew   200 Oct 31 23:52 .
drwxr-xr-x 10 andrew andrew   200 Oct 31 23:52 ..
-rw-r--r--  1 andrew andrew 41149 Sep 30 21:53 Trolltech.conf
drwx------  2 andrew andrew  4096 Oct 29 03:45 dconf
drwx------  2 andrew andrew  4096 Oct 29 03:56 gtk-2.0
drwxr-xr-x  2 andrew andrew  4096 Oct 31 22:07 gtk-3.0
drwx------  3 andrew andrew  4096 Feb 14  2014 ibus
-rw-------  1 andrew andrew   102 Mar 13  2017 mimeapps.list
drwxr-xr-x  4 andrew andrew  4096 Sep 30 21:53 qt5ct
-rw-------  1 andrew andrew   695 Jun  8  2016 user-dirs.dirs

As can be seen files within .private/.config are set normally, but .config symlinks is not preserved. The only dir "dconf" is there because of the following in whitelist-common.inc:

# dconf
mkdir ${HOME}/.config/dconf
whitelist ${HOME}/.config/dconf

If I comment mkdir line, then .config directory is not created at all.

For now as a workaround I added a script which creates all necessary symlinks before running firefox, but this affects other applications as well and the bug is very annoying. Please fix it by preserving all parent symlinks when necessary.

@bircoph commented on GitHub (Oct 31, 2018): I have issue №2 with firejail-0.9.56 on Gentoo: I have some directories in $HOME an symlinks, e.g.: `.config -> .private/.config` And now whitelists and blacklists for files within .config doesn't work properly: `$ firejail --profile=/etc/firejail/firefox.profile bash:` ``` $ ls -al .config total 0 drwx------ 3 andrew andrew 60 Oct 31 23:52 . drwx------ 7 andrew andrew 280 Oct 31 23:52 .. drwx------ 2 andrew andrew 40 Oct 31 23:52 dconf $ ls -al .private/.config total 72 drwxr-xr-x 7 andrew andrew 200 Oct 31 23:52 . drwxr-xr-x 10 andrew andrew 200 Oct 31 23:52 .. -rw-r--r-- 1 andrew andrew 41149 Sep 30 21:53 Trolltech.conf drwx------ 2 andrew andrew 4096 Oct 29 03:45 dconf drwx------ 2 andrew andrew 4096 Oct 29 03:56 gtk-2.0 drwxr-xr-x 2 andrew andrew 4096 Oct 31 22:07 gtk-3.0 drwx------ 3 andrew andrew 4096 Feb 14 2014 ibus -rw------- 1 andrew andrew 102 Mar 13 2017 mimeapps.list drwxr-xr-x 4 andrew andrew 4096 Sep 30 21:53 qt5ct -rw------- 1 andrew andrew 695 Jun 8 2016 user-dirs.dirs ``` As can be seen files within .private/.config are set normally, but .config symlinks is not preserved. The only dir "dconf" is there because of the following in whitelist-common.inc: ``` # dconf mkdir ${HOME}/.config/dconf whitelist ${HOME}/.config/dconf ``` If I comment mkdir line, then .config directory is not created at all. For now as a workaround I added a script which creates all necessary symlinks before running firefox, but this affects other applications as well and the bug is very annoying. Please fix it by preserving all parent symlinks when necessary.

gitea-mirror commented

2026-05-05 07:12:53 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Oct 31, 2018):

@bircoph if you are using ecryptfs for that .private directory, consider switching to full home directory encryption (ecryptfs-migrate-home) instead as cleaner workaround for now.

slight ot: also see https://defuse.ca/audits/ecryptfs.htm

@SkewedZeppelin commented on GitHub (Oct 31, 2018): @bircoph if you are using ecryptfs for that .private directory, consider switching to full home directory encryption (ecryptfs-migrate-home) instead as cleaner workaround for now. slight ot: also see https://defuse.ca/audits/ecryptfs.htm

gitea-mirror commented

2026-05-05 07:12:54 -06:00

Author

Owner

@bircoph commented on GitHub (Oct 31, 2018):

No, I do not use ecryptfs. I use LUKS, though I do not want to encrypt full home due to various reasons.

@bircoph commented on GitHub (Oct 31, 2018): No, I do not use ecryptfs. I use LUKS, though I do not want to encrypt full home due to various reasons.

gitea-mirror commented

2026-05-05 07:12:55 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 21, 2019):

LUKS shouldn't affect this. Is this still an issue?

@chiraag-nataraj commented on GitHub (May 21, 2019): LUKS shouldn't affect this. Is this still an issue?

gitea-mirror commented

2026-05-05 07:12:56 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 22, 2019):

@liloman @bircoph
I'm closing here due to inactivity, please fell free to reopen if you still have this issue.

@rusty-snake commented on GitHub (Aug 22, 2019): @liloman @bircoph I'm closing here due to inactivity, please fell free to reopen if you still have this issue.

gitea-mirror referenced this issue

2026-05-05 10:08:13 -06:00

[PR #949] [MERGED] gajim fix #3803

Rows
Columns

[GH-ISSUE #1388] 2 gotchas with whitelist (ending / and origin dir of a symlinked file) #949