[GH-ISSUE #1419] Archive Managers can't acces network folders

gitea-mirror commented

2026-05-05 07:13:51 -06:00

Owner

Originally created by @Utini2000 on GitHub (Jul 31, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1419

Hello everyone,
I am on Archlinux and due to the network restriction the following archive managers aren't able to access/extract to/from network shared folders:

file-roller
xarchiver
ark

I can manually edit the .conf but it will be overwritten after each update? Or to .local files always trump .profile files? Besides that I think it should still be possible for those application to exttract to network folders?

Thanks in advance !

Originally created by @Utini2000 on GitHub (Jul 31, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1419 Hello everyone, I am on Archlinux and due to the network restriction the following archive managers aren't able to access/extract to/from network shared folders: file-roller xarchiver ark I can manually edit the .conf but it will be overwritten after each update? Or to .local files always trump .profile files? Besides that I think it should still be possible for those application to exttract to network folders? Thanks in advance !

gitea-mirror

2026-05-05 07:13:51 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 07:13:56 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 1, 2017):

You can always put

include /etc/firejail/file-roller.profile
ignore net

or something in a profile in ~/.config/firejail/file-roller.profile.

I do disagree, though, that archive managers should have access to the network. If you need it to extract something on the network, the right way (IMHO) is to mount that filesystem to a local mount point (e.g. using sshfs) and then treat it as a local resource. Because the sshfs process is running outside the sandbox, you won't have any problems regarding actually writing the files.

@chiraag-nataraj commented on GitHub (Aug 1, 2017): You can always put ```` include /etc/firejail/file-roller.profile ignore net ```` or something in a profile in `~/.config/firejail/file-roller.profile`. I do disagree, though, that archive managers should have access to the network. If you need it to extract something on the network, the right way (IMHO) is to mount that filesystem to a local mount point (e.g. using sshfs) and then treat it as a local resource. Because the sshfs process is running outside the sandbox, you won't have any problems regarding actually writing the files.

gitea-mirror commented

2026-05-05 07:13:57 -06:00

Author

Owner

@Utini2000 commented on GitHub (Aug 2, 2017):

Hmm I am on Arch + Gnome and mounted an locally shared hdd via SMB in Nemo. That didnt work

@Utini2000 commented on GitHub (Aug 2, 2017): Hmm I am on Arch + Gnome and mounted an locally shared hdd via SMB in Nemo. That didnt work

gitea-mirror commented

2026-05-05 07:13:59 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 2, 2017):

Interesting. I know that it works for sshfs. I ssh in and mount a certain directory to /media/ccv. Then I can open up a jailed x-terminal-emulator (urxvt in my case) which does not have internet access and still read from/write to /media/ccv.

@chiraag-nataraj commented on GitHub (Aug 2, 2017): Interesting. I know that it works for `sshfs`. I `ssh` in and mount a certain directory to `/media/ccv`. Then I can open up a jailed `x-terminal-emulator` (`urxvt` in my case) _which does not have internet access_ and still read from/write to `/media/ccv`.

gitea-mirror commented

2026-05-05 07:14:00 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Aug 2, 2017):

The gvfs-* providers seem to be incompatible compared to sshfs. Most likely because sshfs creates an actual mount instead of just a weird virtual directory. See https://askubuntu.com/a/87702

Oddly even after giving file-roller network access I was still unable to compress files accessed via gvfs-sftp.

@SkewedZeppelin commented on GitHub (Aug 2, 2017): The gvfs-* providers seem to be incompatible compared to sshfs. Most likely because sshfs creates an actual mount instead of just a weird virtual directory. See https://askubuntu.com/a/87702 Oddly even after giving file-roller network access I was still unable to compress files accessed via gvfs-sftp.

gitea-mirror commented

2026-05-05 07:14:01 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 3, 2017):

Huh...I see. Yeah, I guess I stopped using gvfs stuff a long time ago xD

@chiraag-nataraj commented on GitHub (Aug 3, 2017): Huh...I see. Yeah, I guess I stopped using gvfs stuff a long time ago xD

gitea-mirror commented

2026-05-05 07:14:02 -06:00

Author

Owner

@Utini2000 commented on GitHub (Aug 3, 2017):

Hmm so even grqnting network access wont help?
How to fix this then? :o

@Utini2000 commented on GitHub (Aug 3, 2017): Hmm so even grqnting network access wont help? How to fix this then? :o

gitea-mirror commented

2026-05-05 07:14:02 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 11, 2017):

@Utini2000, are you using smbnetfs? You could give that a try rather than gvfs (I think smbnetfs uses FUSE instead).

@chiraag-nataraj commented on GitHub (Aug 11, 2017): @Utini2000, are you using `smbnetfs`? You could give that a try rather than `gvfs` (I think `smbnetfs` uses FUSE instead).

gitea-mirror commented

2026-05-05 07:14:03 -06:00

Author

Owner

@ghost commented on GitHub (Jun 7, 2018):

I'm having the same issue atm with Firejail 0.9.54, where or what do I edit to have this working again, I need access to my drive asap. I've removed it for now until I can figure this out or get help.

System is Kubuntu 18.04 LTS and my WD Passport drive is attached to my router (Asus RT-AC86U)

@ghost commented on GitHub (Jun 7, 2018): I'm having the same issue atm with Firejail 0.9.54, where or what do I edit to have this working again, I need access to my drive asap. I've removed it for now until I can figure this out or get help. System is Kubuntu 18.04 LTS and my WD Passport drive is attached to my router (Asus RT-AC86U)

gitea-mirror commented

2026-05-05 07:14:04 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jun 7, 2018):

@GeoffK59 See if #1560 helps.

@chiraag-nataraj commented on GitHub (Jun 7, 2018): @GeoffK59 See if #1560 helps.

gitea-mirror commented

2026-05-05 07:14:05 -06:00

Author

Owner

@ghost commented on GitHub (Jun 7, 2018):

@chiraag-nataraj I read that thread but I'm still a bit confused as to what or where to edit and or be able to restrict access at will. Honestly I don't understand why Firejail is restricting this as I'm root and should therefore have access no matter what.

@ghost commented on GitHub (Jun 7, 2018): @chiraag-nataraj I read that thread but I'm still a bit confused as to what or where to edit and or be able to restrict access at will. Honestly I don't understand why Firejail is restricting this as I'm root and should therefore have access no matter what.

gitea-mirror commented

2026-05-05 07:14:06 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 16, 2018):

@GeoffK59 firejail is just restricting based on its profile. It doesn't care about whether you're root or another user (unless you're trying to use a feature which is restricted to root, of course).

If you're using a FUSE filesystem (e.g. sshfs), try mounting with -o allow_others.

@chiraag-nataraj commented on GitHub (Jul 16, 2018): @GeoffK59 `firejail` is just restricting based on its profile. It doesn't care about whether you're root or another user (unless you're trying to use a feature which is restricted to root, of course). If you're using a FUSE filesystem (e.g. sshfs), try mounting with `-o allow_others`.

gitea-mirror commented

2026-05-05 07:14:07 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 22, 2018):

I think allowing archive managers to access the network is bad as a default. In general, a more secure workflow is copying the file to a shared directory (say, ~/Downloads) and using the archive manager there. Of course, if people want to locally allow network access, that makes sense. But I don't think we should do that by default.

@GeoffK59 I'm going to close this due to no response. If you try that and still can't get it to work, please feel free to reopen.

@chiraag-nataraj commented on GitHub (Jul 22, 2018): I think allowing archive managers to access the network is bad as a default. In general, a more secure workflow is copying the file to a shared directory (say, `~/Downloads`) and using the archive manager there. Of course, if people want to locally allow network access, that makes sense. But I don't think we should do that by default. @GeoffK59 I'm going to close this due to no response. If you try that and still can't get it to work, please feel free to reopen.

Rows
Columns

[GH-ISSUE #1419] Archive Managers can't acces network folders #965