Nowhitelist option does not disable whitelisting entirely

[jose1711]

Say I have a profile shipped with firejail that enables whitelisting of $DOWNLOADS. Something like this:

# cat /etc/firejail/foo.profile
include foo.local
whitelist ${DOWNLOADS}

Let's assume we want to disable whitelisting so we create a foo.local file and add nowhitelist:

nowhitelist ${DOWNLOADS}

One would expect that whitelisting is effectively disabled but this is not true:

~ ls -l random_file                                                
-rw-r--r-- 1 jose users 7 Jul 31 22:41 random_file
~ firejail --profile=/etc/firejail/foo.profile ls -la ~/random_file      
Reading profile /etc/firejail/foo.profile
Reading profile /etc/firejail/foo.local
Parent pid 15790, child pid 15791
Child process initialized in 62.67 ms
ls: cannot access '/home/jose/random_file': No such file or directory

Parent is shutting down, bye...

[netblue30]

As soon as it runs into a whitelist statement, firejail will mount a temporary filesystem on top of your directory. It doesn't matter if you already unwhitelisted the file.

[jose1711]

Note that here whitelist and nowhitelist both mention the same directory. So my understanding of this would be:

• firejail builds a list of files/directories to be whitelisted
• ${DOWNLOADS} enters this list but is shortly removed from it by nowhitelist option
• at the end there are no files/dirs to be whitelisted hence the mounting over tempfs does not occur

[rusty-snake]

@jose1711 Not looked in the code, but I think @netblue30 mean that firejail do the mount on top of $HOME (or what every) once it finds a whitelist and then check which files need to be bind-mounted.

Here firejail see a whitelist ${HOME}/something and mount a new empty fs on top of $HOME then it see it has do be bind-mount ${DOWNLOADS} but Uhh wait there was prevouisly a nowhitelist ${DOWNLOADS}. So it skip the bind-mount of DOWNLOADS and go ahead (to the next whitelist ~/some).

[rusty-snake]

How to proceed?

[rusty-snake]

If there is no whitelist ${HOME} after nowhitelist the whitelisting of ${HOME} should IMHO be disabled, because it will break disabling whitelist in .local files and force users to copy .profile or edit in etc.

[rusty-snake]

@smitsohu this get fixed once or new whitelist implementation gets merged, right?

[smitsohu]

@rusty-snake the alternative whitelist implementation would fix it, yes.