Firejail: HOME environment variable not adjusted when using --user

[lheckemann]

$ sudo firejail --user=$USER sh
$ echo $HOME
/root

[Fred-Barclay]

I believe this from the README.md might help:
--user option was deprecated, please use "sudo -u username firejail application" instead.
:smile_cat:

[lheckemann]

Oops. But I guess there's no way to give an unprivileged jail capabilities then?

[Fred-Barclay]

I don't know about that; maybe @netblue30 or someone else with more experience could answer that better than I could. It will probably also depend on _which_ capabilities you want to give the jail. :wink:
But my guess would be sudo -u root firejail <application>.

[lheckemann]

But I don't want to run it as root, I want to run it as an unprivileged user gaining just certain capabilities like net_bind_service.

[netblue30]

I had to remove --user because it was equivalent with "sudo -u username firejail application".

If you need a program to keep certain capabilities, the standard way is to use "setcap" command. Here is an example of how they do it for ping: https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/

[lheckemann]

Ah right, thanks!