When using --private=<DIR>, an existing "bin" directory in <DIR> is read-only. This is silly: this means that one cannot restart a firejail session: zira:~> firejail --private=$HOME/fj-test zsh Reading profile /etc/firejail/default.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc Warning: networking feature is disabled in Firejail configuration file ** Note: you can use --noprofile to disable default.profile ** Parent pid 685072, child pid 685073 Child process initialized in 47.87 ms zira% mkdir bin zira% touch bin/foo zira% ls -l bin total 0 -rw-r--r-- 1 vinc17 vinc17 0 2021-03-01 02:32:19 foo zira% Parent is shutting down, bye... zira:~> firejail --private=$HOME/fj-test zsh Reading profile /etc/firejail/default.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc Warning: networking feature is disabled in Firejail configuration file ** Note: you can use --noprofile to disable default.profile ** Parent pid 685097, child pid 685098 Child process initialized in 51.94 ms zira% touch bin/blah touch: cannot touch 'bin/blah': Read-only file system I don't see the point to have "bin" read-only in this case, as the purpose of "--private=" is that this "bin" directory is specific to the firejail session.
Hi Vincent,
[...]
The reason why the bin directory is mounted read-only is the
disable-common.inc file that is included in the default and many other
profiles:
read-only ${HOME}/bin
It's writable the first time, because it does not exist yet when the
jail is created.
If you want to allow writing in this directory, you can add a local
override in the file /etc/firejail/disable-common.local with this line:
ignore read-only ${HOME}/bin
Alternatively you can create your own profile that does not include
disable-common.inc.
Kind regards,
Reiner
AFAIK, the goal of this line is to make bin from the user's home
directory read-only. This is useful as a general rule, where the
user's home directory in the jail is the same as the normal one
(it seems that disable-common.inc is included by all profiles).
This is misused in the case of a private home directory. This rule
should apply against the original home directory, not the private
home directory.
The same should apply to all the other "read-only ${HOME}/..." rules
as well.
Hi Vincent,
I've raised the question upstream what the intended behaviour of ${HOME}
is, whether is should apply to the private home as well or not.
I can imagine that one would also be interested in having ${HOME} rules
apply to the private directory. You could still have sensitive files
inside a private home directory that you want to protect from
processes running in there.
Kind regards,
Reiner
I would have thought that the typical use is to create a directory, copy a minimum number of (non-confidential) files in it, and do all the dirty work in it via "firejail --private=". I do that for testing actively developed 3rd party software, and this needs something like "make install" each time the software is updated. If bin is read-only, this doesn't work.