Firejail: /dev/fd symlink is missing when using private-dev

[simonfxr]

When enabling private-dev a symlink from /dev/fd -> /proc/self/fd is missing. It might be a good idea to just create it, e.g. bash uses it for process substitution.

[Vincent43]

We may consider re-examining private-dev contents in general. For example here's the difference between content exposed by firejail vs flatpak:

$ firejail --noprofile --private-dev bash
Warning: an existing sandbox was detected. bash will run without any additional sandboxing features
$ ls /dev
dri  full  hidraw0  hidraw1  hidraw2  hidraw3  hidraw4  hidraw5  log  null  ptmx  pts  random  shm  snd  tty  urandom  usb  zero

$ flatpak run org.freedesktop.Platform
[📦 org.freedesktop.Platform ~]$ ls /dev
console  core  fd  full  null  ptmx  pts  random  shm  stderr  stdin  stdout  tty  urandom  zero

[rusty-snake]

stderr, stdin, stdout will also be used in some scripts.

[netblue30]

OK, I'll add /dev/fd,stderr,stdin,stdout. These are symlinks to existing files in /proc.

I'll get rid of /dev/log, it makes sense only for running servers as root. The others are more problematic:

• /dev/snd is the sound card, mainly used by ALSA - flatpak supports only pulseaudio
• /dev/dri is the 3D acceleration
• /dev/hidraw* - human interface device, it could be anything: mouse, keyboard, audio card...
• /dev/usb - I think it is brought in by the hidraw devices above.

[Vincent43]

To complete above /dev/snd can be removed with --nosound, /dev/dri by --no3d and /dev/hidraw* + /dev/usb by --nou2f.

[smitsohu]

The original issue is fixed in f25e8d684659eb001407d3eaa58f90671acdd1a9