Firejail: Can't seem to stop .Xauthority or .asound from being created/copied

[rusty-snake]

1. --private=./ for what?
2. firejail --x11=none --net=none --nosound ls -l .Xauthority should show you r-------- and owner: nobody => firejail --x11=none --net=none --nosound cat .Xauthority ends in Permission denied
3. If you want that they don't exist, you need to use whitelist.
   EDIT:
   To deny access to .asound you need --blacklist=${HOME}/.asound.

[slackhead]

Hi

1 I need to block any writing to filesystem except for the current directory and /tmp. --chroot seems to want the cwd to be owned by root.

2 The current directory is a build directory whch will be synced with a git repo after each shell script has been tested, so I don't want any extra files created.

I have tried to whitelist them but it makes no difference:

whitelist ${HOME}/.asoundrc
whitelist ${HOME}/.Xauthority

in both default.profile and whitelist-common.inc.

Thanks

EDIT

It seems --chroot wants a real chroot with /proc etc. anyway.

[rusty-snake]

Well, now I get you setup and intend.

I have tried to whitelist them but it makes no difference:

whitelisting the files you want, not the files you don't want. Anyway.

I need to block any writing to filesystem except for the current directory and /tmp.

--private=. will only protect ${HOME}.
You can use --read-only=PATH to mount PATH ro.

[rusty-snake]

@slackhead can you try firejail --x11=none --net=none --nosound --whitelist=${HOME}/GIT_REPO bash SCRIPT

[slackhead]

Thanks, that helps a lot. I have a couple of different ideas. This one blacklists /tmp too:

firejail \
  --shell=none \
  --net=none \
  --x11=none \
  --nosound \
  --blacklist=/tmp \
  --whitelist=`pwd` \
  --noprofile $@

I also will need to run some scripts as root and be able to use ccache. I think something like this should work if I set the ccache directory to a named overlay in /root/.firejail/sbo/odiff/root/.ccache

firejail \
--net=none \
--shell=none \
--nosound \
--x11=none \
--noprofile \
--read-only=`pwd` \
--overlay-named=sbo \
sh <script>

Hopefully that leaves only /tmp writeable, and I should be able to find /root/.firejail to see if anything tried write anywhere else.

[smitsohu]

IMHO it would be "more right" to indeed not copy these files if there is a nosound or x11 none option.

[smitsohu]

Should be fixed.