Firejail: For --private-tmp expose /tmp/.X11-unix as read-only

Created on 22 Nov 2018  路  3Comments  路  Source: netblue30/firejail

Currently in case of private-tmp option we mount an empty /tmp with whitelisted /tmp/.X11-unix. Additionally we may expose it as read-only. The read-only mount flag does not prevent using connect() syscall on the socket.

picture Vincent43

Most helpful comment

I think it should be built into --private-tmp directly to avoid cluttering profiles.

picture Vincent43 on 10 Dec 2018
👍3

All 3 comments

@Vincent43 Is the easiest way to do this to build it in to --private-tmp or to just add it to the profiles directly?

chiraag-nataraj picture chiraag-nataraj on 9 Dec 2018

I think it should be built into --private-tmp directly to avoid cluttering profiles.

Vincent43 picture Vincent43 on 10 Dec 2018
👍3

Going to close this as this should now be implemented.

chiraag-nataraj picture chiraag-nataraj on 20 May 2019
Was this page helpful?
0 / 5 - 0 ratings

Related issues

Fincer picture Fincer  路  4Comments
semente picture semente  路  4Comments
yourcelf picture yourcelf  路  4Comments
nuxwin picture nuxwin  路  3Comments
fl-chris picture fl-chris  路  4Comments