Firejail: Whitelisting doesn't work if whitelisted path is a symlink

[n1trux]

cp -a ~/Downloads /opt/
ln -s /opt/Downloads ~/Downloads
ln -s /usr/bin/firejail /usr/local/bin/firefox
firefox

error is:

Error: invalid whitelist path /home/n1trux/Downloads

[netblue30]

I guess I should allow this type of functionality. Let me think about it, thanks!

[tobykurien]

+1 - worked with older versions (in Ubuntu) but stopped working on current version

[liloman]

Same here.
I can't access .mplayer path from firefox cause It's a symlink to my dotfiles.

Even more I think I can't blacklist /bin -> /usr/bin from firefox for the very same reason and private-bin is not working either...

[sciamano]

I have the issue too: my .cache is symlinked to /dev/shm/unburden-username/cache using unburden-home-dir and the default FF profile from /etc/firejail/firefox.profile leads to
Error: invalid whitelist path /home/username/.cache/mozilla/firefox

PS: using version from debian testing

[netblue30]

I think I will have to drop this enhancement. I cannot allow symlinks from /home/user and from /tmp directories. There will be tones of security problems related to SUID binary. The safe thing for now is to wait, maybe somebody comes up with an idea how this can be done safely.

[liloman]

So which do you think will be the solution for those using symlinks?

Hardlinks? (if the same partition)

I have to do something with this issue for sure cause the .mplayer issue is rather cumbersome for me (but how there isn't audio yet it is really not important cause I stopped launching mplayer/youtube-dl from the brower, bothersome but "temporal" till fixed the sound issue). ;)

[netblue30]

I don't know, maybe I can allow it on Grsecurity systems. It is really a kernel problem, never recognized as such by the kernel people.

[liloman]

They are starting to implement grsecurity now... so who knows? :dancer:

What about checking for symlinks and using readlink to point to the target dir? It would be a userspace solution and Torvalds would be pretty happy about that. ;)

[netblue30]

Whitelisting symlinks outside user home directory is implemented.

[liloman]

Awesome man. :)

I just figured it out right now.

Nice!

[TensorTom]

Not working for me. Using 0.9.54

[Linux-Fan]

firejail --apparmor opera --disable-seccomp-filter-sandbox
Reading profile /home/zbyszek/.config/firejail/opera.profile
Reading profile /etc/firejail/chromium-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 3692, child pid 3693
Error: invalid whitelist path /home/zbyszek/.config/opera
Error: proc 3692 cannot sync with peer: unexpected EOF
Peer 3693 unexpectedly exited with status 1

[cjsthompson]

Same problem here (Arch Linux x86-64, apparmor enabled). Firefox will start but I'll get an error message that I can't save my downloads to ~/Downloads which is a symlink to a downloads folder on another btrfs subvolume.

[glitsj16]

@cjsthompson Where exactly is that other btrfs subvolume mounted? Keep in mind that /etc/firejail/firefox-common.profile uses disable-mnt, so that will block access to /mnt, /media, /run/mount and /run/media. You will have to explicitly grant access to the symlinked downloads folder.

[cjsthompson]

It's mounted on /data and chown -R ~user.~user and chmod -R 0750.

[glitsj16]

@cjsthompson Have you tried adding whitelist /data to a firefox-common.local file yet?

[cjsthompson]

Not a firefox-common.local but the /etc/firejail/whitelist-common.local and when I do that, then firefox won't start at all with "invalid whitelist path".

[Vincent43]

/data is unusual path. Maybe you could use /mnt or /media ?

[cjsthompson]

I found the problem. It's in /etc/apparmor.d/firejail-default :

##########
# Allow write access to paths writable in firejail which aren't used for
# executing programs. /run, /proc and /sys are handled separately.
# Line starting with /run/firejail/mnt/oroot deal with --overlay sandboxes.
##########
/{,run/firejail/mnt/oroot/}{dev,etc,home,media,mnt,root,srv,tmp,var}/** w,

Adding /data to this list fixes the problem. Perhaps it would be useful to mention this somewhere.

[Vincent43]

You may add local apparmor modifications to /etc/apparmor.d/local/firejail-{default,local} like:
/data/** w,

[cjsthompson]

That's indeed even better. Thanks for the tip.