1

I can create a bash script, then launch it using firejail with the private option :

phil@GLaDOS:~$ echo "echo success" > /media/phil/Stockage/firejailtest.sh; chmod +x /media/phil/Stockage/firejailtest.sh 
phil@GLaDOS:~$ firejail --noprofile --private /media/phil/Stockage/firejailtest.sh 
Parent pid 117110, child pid 117111
Child process initialized in 8.67 ms
success

Parent is shutting down, bye...

Which works fine.

However, if my script is in my home directory, or any folder in the home directory, the above will fail :

phil@GLaDOS:~$ echo "echo success" > /home/phil/firejailtest.sh; chmod +x /home/phil/firejailtest.sh 
phil@GLaDOS:~$ firejail --noprofile --private /home/phil/firejailtest.sh 
Parent pid 117357, child pid 117358
Child process initialized in 8.73 ms
/bin/bash: ligne 1: /home/phil/firejailtest.sh: No such file or directory

Parent is shutting down, bye...

How do I launch a script or program within my home directory, with firejail, using "private" to ensure no modification is made to any of my files?

1 Answer 1

1

From man firejail:

--private

Mount new /root and /home/user directories in temporary filesystems. All modifications are discarded when the sandbox is closed.

Example:

$ firejail --private firefox

--private-home=file,directory

Build a new user home in a temporary filesystem, and copy the files and directories in the list in the new home. The files and directories in the list must be expressed as relative to the current user's home directory. All modifications are discarded when the sandbox is closed.

Example:

$ firejail --private-home=.mozilla firefox

The options for all intents and purposes are doing the same. So you could use instead:

firejail --noprofile --private-home=firejailtest.sh /home/phil/firejailtest.sh

You can verify that the only difference is this additional file:

firejail --noprofile --private find /home/phil

versus:

firejail --noprofile --private-home=firejailtest.sh find /home/phil

Nitpicking: the two options are doing almost the same but not exactly (hence: "for all intents and purposes" above) as can be seen with:

 firejail --noprofile --private cat /proc/self/mountinfo

versus:

 firejail --noprofile --private-home=firejailtest.sh cat /proc/self/mountinfo
2
  • 1
    As I understand it: under private, the location of the script itself is no more accessible, so you have to move the script to the new home before launching it. If however you're under /media, the location is always accessible even with the private option
    – sayanel
    Sep 24 at 9:14
  • Yes (except it's a copy (in a tmpfs) not a move).
    – A.B
    Sep 24 at 10:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.