How to enable a user to access another user's directory in firejail?

[muziker]

If user A has group access to user B, how do i enable this while running firejail?

Currently a firejail --profile=<profile> /bin/bash is going to change the uids+gids for users that are not userA to nobody:nobody. Even if userA is in the group of userB, userA cannot access a group accessible directory. There doesn't seem to be any way to change this.

How can i enable permissions to remain intact for userA to access the group accessible directory of userB?

[rusty-snake]

• allusers to make /home/* visible
• ignore nogroups & ignore noroot to keep users and groups.

[muziker]

Thanks! That's really helpful. Is it possible to have firejail keep users:groups for only particular users/groups, so others are nobody:nobody?

[rusty-snake]

ATM this is not possible.

[kmk3]

@muziker on Oct 26:

Thanks! That's really helpful. Is it possible to have firejail keep
users:groups for only particular users/groups, so others are nobody:nobody?

It would be possible if we had something like groups.keep foo,bar.

Most recent discussion on that:

• Feature Request: Logind conditional #4603

[rusty-snake]

Partly, groups.keep (#2042) is only about clearing/keeping supplementary groups. This would also require to keep other uids/gids in the private user ns like noroot.keep 1001.