Can't make $XDG_RUNTIME_DIR/app readable

[WhyNotHugo]

I have this in firefox.local:

# For KeePassXC:
noblacklist ${RUNUSER}/app/
noblacklist ${RUNUSER}/app/org.keepassxc.KeePassXC/
mkdir       ${RUNUSER}/app/org.keepassxc.KeePassXC/
whitelist   ${RUNUSER}/app/
whitelist   ${RUNUSER}/app/org.keepassxc.KeePassXC/

But inside the sandbox, app is not user-readable:

$ ls -l $XDG_RUNTIME_DIR/
total 0
dr-------- 2 nobody nobody 40 May 17 18:31 app
-r-------- 1 nobody nobody  0 May 17 18:31 bus
drwx------ 2 hugo   hugo   60 May 17 18:31 dconf
srw-rw-rw- 1 hugo   hugo    0 May 17 18:28 pipewire-0
drwxr-xr-x 2 hugo   hugo   60 May 17 19:16 pulse
srwxr-xr-x 1 hugo   hugo    0 May 17 18:28 wayland-1

Any ideas what's wrong? The directory belongs to hugo:hugo outside the sandbox.

[rusty-snake]

writable-run-user

[WhyNotHugo]

Huh? From firejail-profile:

       writable-run-user
              Disable   the   default   blacklisting   of    run/user/$UID/systemd    and
              /run/user/$UID/gnupg.

Is that out of date?

[WhyNotHugo]

Doesn't look like that writable-run-user covers this directory too:

firejail/src/firejail/fs.c

Lines 789 to 814 in baeec77

	// disable various ipc sockets in /run/user
	if (!arg_writable_run_user) {
	char *fname;
	if (asprintf(&fname, "/run/user/%d", getuid()) == -1)
	errExit("asprintf");
	if (is_dir(fname)) { // older distros don't have this directory
	// disable /run/user/{uid}/gnupg
	char *fnamegpg;
	if (asprintf(&fnamegpg, "/run/user/%d/gnupg", getuid()) == -1)
	errExit("asprintf");
	if (create_empty_dir_as_user(fnamegpg, 0700))
	fs_logger2("create", fnamegpg);
	disable_file(BLACKLIST_FILE, fnamegpg);
	free(fnamegpg);
	// disable /run/user/{uid}/systemd
	char *fnamesysd;
	if (asprintf(&fnamesysd, "/run/user/%d/systemd", getuid()) == -1)
	errExit("asprintf");
	if (create_empty_dir_as_user(fnamesysd, 0755))
	fs_logger2("create", fnamesysd);
	disable_file(BLACKLIST_FILE, fnamesysd);
	free(fnamesysd);
	}
	free(fname);
	}

[rusty-snake]

Wait why is this then named writeable-run-user?!

[rusty-snake]

Anyway this is the blacklist you need to noblacklist:

firejail/etc/inc/disable-common.inc

Line 595 in 78aaed1

blacklist ${RUNUSER}/app

[WhyNotHugo]

Oh, it is noblacklistd, but the trailing slash is significant, so noblacklist ${RUNUSER}/app/ is not the same as noblacklist ${RUNUSER}/app. Removing the trailing slash fixed it.