How to blacklist /sbin and /usr/sbin? #6410

gcb · 2024-07-16T17:07:54Z

gcb
Jul 16, 2024

I've updated my gimp.profile and commented out these two lines:
(at first i tried adding blacklist lines to my .local, when that didn't seem to work I edited the .profile)

# See issue #4367, gimp 2.10.22-3: gegl:introspect broken
#noblacklist /sbin
#noblacklist /usr/sbin

run # firecfg

and when i run gimp i get

Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted

And obviously i can reach the files on that dir.

i don't have any change on my default includes that profile uses. --debug or --trace doesn't show anything allowing that dir.

what's going on? why changes to profile+firecfg doesn't seem to work? what step I am missing?

gcb · 2024-07-16T17:11:45Z

gcb
Jul 16, 2024
Author

firejail debug log

Reading profile /etc/firejail/gimp.profile
Building quoted command line: 'gimp' 
Command name #gimp#
Found gimp.profile profile in /etc/firejail directory
Reading profile /etc/firejail/gimp.local
Found gimp.local profile in /etc/firejail directory
Reading profile /etc/firejail/disable-common.inc
Found disable-common.inc profile in /etc/firejail directory
Reading profile /etc/firejail/disable-exec.inc
Found disable-exec.inc profile in /etc/firejail directory
Reading profile /etc/firejail/disable-devel.inc
Found disable-devel.inc profile in /etc/firejail directory
Reading profile /etc/firejail/disable-programs.inc
Found disable-programs.inc profile in /etc/firejail directory
Reading profile /etc/firejail/disable-xdg.inc
Found disable-xdg.inc profile in /etc/firejail directory
Reading profile /etc/firejail/whitelist-run-common.inc
Found whitelist-run-common.inc profile in /etc/firejail directory
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Found whitelist-usr-share-common.inc profile in /etc/firejail directory
Reading profile /etc/firejail/whitelist-var-common.inc
Found whitelist-var-common.inc profile in /etc/firejail directory
[profile] combined protocol list: "unix"
Seccomp list in: !mbind, check list: @default-keep, prelist: unknown,
DISPLAY=:0 parsed as 0
Parent pid 16505, child pid 16507
Initializing child process
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Creating empty /run/firejail/mnt/seccomp directory
Creating empty /run/firejail/mnt/seccomp/seccomp.protocol file
Creating empty /run/firejail/mnt/seccomp/seccomp.namespaces file
Creating empty /run/firejail/mnt/seccomp/seccomp.namespaces.32 file
Creating empty /run/firejail/mnt/seccomp/seccomp.postexec file
Creating empty /run/firejail/mnt/seccomp/seccomp.postexec32 file
sbox run: /run/firejail/lib/fnet ifup lo 
Network namespace enabled, only loopback interface available
Build protocol filter: unix
sbox run: /run/firejail/lib/fseccomp protocol build unix /run/firejail/mnt/seccomp/seccomp.protocol 
Mounting /proc filesystem representing the PID namespace
Basic read-only filesystem:
Mounting read-only /etc
1727 1689 254:2 /etc /etc ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1727 fsname=/etc dir=/etc fstype=ext4
Mounting noexec /etc
1728 1727 254:2 /etc /etc ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1728 fsname=/etc dir=/etc fstype=ext4
Mounting read-only /var
1729 1689 254:2 /var /var ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1729 fsname=/var dir=/var fstype=ext4
Mounting noexec /var
1730 1729 254:2 /var /var ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1730 fsname=/var dir=/var fstype=ext4
Mounting read-only /usr
1731 1689 254:2 /usr /usr ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1731 fsname=/usr dir=/usr fstype=ext4
Mounting tmpfs on /var/lock
Mounting tmpfs on /var/tmp
Mounting tmpfs on /var/log
Create the new utmp file
Mount the new utmp file
Cleaning /home directory
Cleaning /run/user directory
Sanitizing /etc/passwd, UID_MIN 1000
Sanitizing /etc/group, GID_MIN 1000
Disable /run/firejail/sandbox
Disable /run/firejail/network
Disable /run/firejail/bandwidth
Disable /run/firejail/name
Disable /run/firejail/profile
Disable /run/firejail/x11
Mounting tmpfs on /dev
mounting /run/firejail/mnt/dev/dri directory
mounting /run/firejail/mnt/dev/video0 file
mounting /run/firejail/mnt/dev/video1 file
mounting /run/firejail/mnt/dev/video2 file
mounting /run/firejail/mnt/dev/video3 file
Process /dev/shm directory
Generate private-tmp whitelist commands
Creating empty /run/firejail/mnt/dbus directory
Creating empty /run/firejail/mnt/dbus/user file
blacklist /run/user/1000/bus
Creating empty /run/firejail/mnt/dbus/system file
blacklist /run/dbus/system_bus_socket
blacklist /run/firejail/dbus
Mounting read-only /proc/sys
Remounting /sys directory
Disable /sys/firmware
Disable /sys/hypervisor
Disable /sys/power
Disable /sys/kernel/debug
Disable /sys/kernel/vmcoreinfo
Disable /proc/sys/fs/binfmt_misc
Disable /proc/sys/kernel/core_pattern
Disable /proc/sys/kernel/modprobe
Disable /proc/sysrq-trigger
Disable /proc/sys/vm/panic_on_oom
Disable /proc/irq
Disable /proc/bus
Disable /proc/timer_list
Disable /proc/kcore
Disable /proc/kallsyms
Disable /usr/lib/modules/6.9.9-arch1-1/build (requested /usr/src/linux)
Disable /usr/lib/modules (requested /lib/modules)
Disable /boot
Disable /run/user/1000/gnupg
Disable /run/user/1000/systemd
Disable /proc/kmsg
Debug 588: whitelist /usr/share/gegl-0.4
Debug 609: expanded: /usr/share/gegl-0.4
Debug 620: new_name: /usr/share/gegl-0.4
Debug 630: dir: /usr/share
Adding whitelist top level directory /usr/share
Debug 588: whitelist /usr/share/gimp
Debug 609: expanded: /usr/share/gimp
Debug 620: new_name: /usr/share/gimp
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/mypaint-data
Debug 609: expanded: /usr/share/mypaint-data
Debug 620: new_name: /usr/share/mypaint-data
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/lensfun
Debug 609: expanded: /usr/share/lensfun
Debug 620: new_name: /usr/share/lensfun
Debug 630: dir: /usr/share
Debug 588: whitelist /run/NetworkManager/resolv.conf
Debug 609: expanded: /run/NetworkManager/resolv.conf
Debug 620: new_name: /run/NetworkManager/resolv.conf
Debug 630: dir: /run
Adding whitelist top level directory /run
Debug 588: whitelist /run/avahi-daemon/socket
Debug 609: expanded: /run/avahi-daemon/socket
Debug 620: new_name: /run/avahi-daemon/socket
Debug 630: dir: /run
Removed path: whitelist /run/avahi-daemon/socket
	new_name: /run/avahi-daemon/socket
	realpath: (null)
	No such file or directory
Debug 588: whitelist /run/cups/cups.sock
Debug 609: expanded: /run/cups/cups.sock
Debug 620: new_name: /run/cups/cups.sock
Debug 630: dir: /run
Removed path: whitelist /run/cups/cups.sock
	new_name: /run/cups/cups.sock
	realpath: (null)
	No such file or directory
Debug 588: whitelist /run/dbus/system_bus_socket
Debug 609: expanded: /run/dbus/system_bus_socket
Debug 620: new_name: /run/dbus/system_bus_socket
Debug 630: dir: /run
Debug 588: whitelist /run/media
Debug 609: expanded: /run/media
Debug 620: new_name: /run/media
Debug 630: dir: /run
Debug 588: whitelist /run/resolvconf/resolv.conf
Debug 609: expanded: /run/resolvconf/resolv.conf
Debug 620: new_name: /run/resolvconf/resolv.conf
Debug 630: dir: /run
Removed path: whitelist /run/resolvconf/resolv.conf
	new_name: /run/resolvconf/resolv.conf
	realpath: (null)
	No such file or directory
Debug 588: whitelist /run/netconfig/resolv.conf
Debug 609: expanded: /run/netconfig/resolv.conf
Debug 620: new_name: /run/netconfig/resolv.conf
Debug 630: dir: /run
Removed path: whitelist /run/netconfig/resolv.conf
	new_name: /run/netconfig/resolv.conf
	realpath: (null)
	No such file or directory
Debug 588: whitelist /run/shm
Debug 609: expanded: /run/shm
Debug 620: new_name: /run/shm
Debug 630: dir: /run
Removed path: whitelist /run/shm
	new_name: /run/shm
	realpath: (null)
	No such file or directory
Debug 588: whitelist /run/systemd/journal/dev-log
Debug 609: expanded: /run/systemd/journal/dev-log
Debug 620: new_name: /run/systemd/journal/dev-log
Debug 630: dir: /run
Debug 588: whitelist /run/systemd/journal/socket
Debug 609: expanded: /run/systemd/journal/socket
Debug 620: new_name: /run/systemd/journal/socket
Debug 630: dir: /run
Debug 588: whitelist /run/systemd/resolve/resolv.conf
Debug 609: expanded: /run/systemd/resolve/resolv.conf
Debug 620: new_name: /run/systemd/resolve/resolv.conf
Debug 630: dir: /run
Debug 588: whitelist /run/systemd/resolve/stub-resolv.conf
Debug 609: expanded: /run/systemd/resolve/stub-resolv.conf
Debug 620: new_name: /run/systemd/resolve/stub-resolv.conf
Debug 630: dir: /run
Debug 588: whitelist /run/udev/data
Debug 609: expanded: /run/udev/data
Debug 620: new_name: /run/udev/data
Debug 630: dir: /run
Debug 588: whitelist /run/opengl-driver
Debug 609: expanded: /run/opengl-driver
Debug 620: new_name: /run/opengl-driver
Debug 630: dir: /run
Removed path: whitelist /run/opengl-driver
	new_name: /run/opengl-driver
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/alsa
Debug 609: expanded: /usr/share/alsa
Debug 620: new_name: /usr/share/alsa
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/applications
Debug 609: expanded: /usr/share/applications
Debug 620: new_name: /usr/share/applications
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/ca-certificates
Debug 609: expanded: /usr/share/ca-certificates
Debug 620: new_name: /usr/share/ca-certificates
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/crypto-policies
Debug 609: expanded: /usr/share/crypto-policies
Debug 620: new_name: /usr/share/crypto-policies
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/crypto-policies
	new_name: /usr/share/crypto-policies
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/cursors
Debug 609: expanded: /usr/share/cursors
Debug 620: new_name: /usr/share/cursors
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/cursors
	new_name: /usr/share/cursors
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/dconf
Debug 609: expanded: /usr/share/dconf
Debug 620: new_name: /usr/share/dconf
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/dconf
	new_name: /usr/share/dconf
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/distro-info
Debug 609: expanded: /usr/share/distro-info
Debug 620: new_name: /usr/share/distro-info
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/distro-info
	new_name: /usr/share/distro-info
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/drirc.d
Debug 609: expanded: /usr/share/drirc.d
Debug 620: new_name: /usr/share/drirc.d
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/egl
Debug 609: expanded: /usr/share/egl
Debug 620: new_name: /usr/share/egl
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/egl
	new_name: /usr/share/egl
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/enchant
Debug 609: expanded: /usr/share/enchant
Debug 620: new_name: /usr/share/enchant
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/enchant
	new_name: /usr/share/enchant
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/enchant-2
Debug 609: expanded: /usr/share/enchant-2
Debug 620: new_name: /usr/share/enchant-2
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/file
Debug 609: expanded: /usr/share/file
Debug 620: new_name: /usr/share/file
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/fontconfig
Debug 609: expanded: /usr/share/fontconfig
Debug 620: new_name: /usr/share/fontconfig
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/fonts
Debug 609: expanded: /usr/share/fonts
Debug 620: new_name: /usr/share/fonts
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/fonts-config
Debug 609: expanded: /usr/share/fonts-config
Debug 620: new_name: /usr/share/fonts-config
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/fonts-config
	new_name: /usr/share/fonts-config
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/gir-1.0
Debug 609: expanded: /usr/share/gir-1.0
Debug 620: new_name: /usr/share/gir-1.0
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/gjs-1.0
Debug 609: expanded: /usr/share/gjs-1.0
Debug 620: new_name: /usr/share/gjs-1.0
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/gjs-1.0
	new_name: /usr/share/gjs-1.0
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/glib-2.0
Debug 609: expanded: /usr/share/glib-2.0
Debug 620: new_name: /usr/share/glib-2.0
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/glvnd
Debug 609: expanded: /usr/share/glvnd
Debug 620: new_name: /usr/share/glvnd
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/gtk-2.0
Debug 609: expanded: /usr/share/gtk-2.0
Debug 620: new_name: /usr/share/gtk-2.0
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/gtk-3.0
Debug 609: expanded: /usr/share/gtk-3.0
Debug 620: new_name: /usr/share/gtk-3.0
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/gtk-engines
Debug 609: expanded: /usr/share/gtk-engines
Debug 620: new_name: /usr/share/gtk-engines
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/gtk-engines
	new_name: /usr/share/gtk-engines
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/gtksourceview-3.0
Debug 609: expanded: /usr/share/gtksourceview-3.0
Debug 620: new_name: /usr/share/gtksourceview-3.0
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/gtksourceview-3.0
	new_name: /usr/share/gtksourceview-3.0
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/gtksourceview-4
Debug 609: expanded: /usr/share/gtksourceview-4
Debug 620: new_name: /usr/share/gtksourceview-4
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/hunspell
Debug 609: expanded: /usr/share/hunspell
Debug 620: new_name: /usr/share/hunspell
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/hwdata
Debug 609: expanded: /usr/share/hwdata
Debug 620: new_name: /usr/share/hwdata
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/icons
Debug 609: expanded: /usr/share/icons
Debug 620: new_name: /usr/share/icons
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/icu
Debug 609: expanded: /usr/share/icu
Debug 620: new_name: /usr/share/icu
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/knotifications5
Debug 609: expanded: /usr/share/knotifications5
Debug 620: new_name: /usr/share/knotifications5
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/knotifications5
	new_name: /usr/share/knotifications5
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/kservices5
Debug 609: expanded: /usr/share/kservices5
Debug 620: new_name: /usr/share/kservices5
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/kservices5
	new_name: /usr/share/kservices5
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/Kvantum
Debug 609: expanded: /usr/share/Kvantum
Debug 620: new_name: /usr/share/Kvantum
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/Kvantum
	new_name: /usr/share/Kvantum
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/kxmlgui5
Debug 609: expanded: /usr/share/kxmlgui5
Debug 620: new_name: /usr/share/kxmlgui5
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/libdrm
Debug 609: expanded: /usr/share/libdrm
Debug 620: new_name: /usr/share/libdrm
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/libthai
Debug 609: expanded: /usr/share/libthai
Debug 620: new_name: /usr/share/libthai
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/locale
Debug 609: expanded: /usr/share/locale
Debug 620: new_name: /usr/share/locale
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/mime
Debug 609: expanded: /usr/share/mime
Debug 620: new_name: /usr/share/mime
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/misc
Debug 609: expanded: /usr/share/misc
Debug 620: new_name: /usr/share/misc
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/Modules
Debug 609: expanded: /usr/share/Modules
Debug 620: new_name: /usr/share/Modules
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/Modules
	new_name: /usr/share/Modules
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/myspell
Debug 609: expanded: /usr/share/myspell
Debug 620: new_name: /usr/share/myspell
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/p11-kit
Debug 609: expanded: /usr/share/p11-kit
Debug 620: new_name: /usr/share/p11-kit
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/perl
Debug 609: expanded: /usr/share/perl
Debug 620: new_name: /usr/share/perl
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/perl
	new_name: /usr/share/perl
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/perl5
Debug 609: expanded: /usr/share/perl5
Debug 620: new_name: /usr/share/perl5
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/pipewire
Debug 609: expanded: /usr/share/pipewire
Debug 620: new_name: /usr/share/pipewire
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/pixmaps
Debug 609: expanded: /usr/share/pixmaps
Debug 620: new_name: /usr/share/pixmaps
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/pki
Debug 609: expanded: /usr/share/pki
Debug 620: new_name: /usr/share/pki
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/pki
	new_name: /usr/share/pki
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/plasma
Debug 609: expanded: /usr/share/plasma
Debug 620: new_name: /usr/share/plasma
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/publicsuffix
Debug 609: expanded: /usr/share/publicsuffix
Debug 620: new_name: /usr/share/publicsuffix
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/publicsuffix
	new_name: /usr/share/publicsuffix
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/qt
Debug 609: expanded: /usr/share/qt
Debug 620: new_name: /usr/share/qt
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/qt4
Debug 609: expanded: /usr/share/qt4
Debug 620: new_name: /usr/share/qt4
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/qt4
	new_name: /usr/share/qt4
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/qt5
Debug 609: expanded: /usr/share/qt5
Debug 620: new_name: /usr/share/qt5
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/qt5
	new_name: /usr/share/qt5
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/qt5ct
Debug 609: expanded: /usr/share/qt5ct
Debug 620: new_name: /usr/share/qt5ct
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/qt5ct
	new_name: /usr/share/qt5ct
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/qt6
Debug 609: expanded: /usr/share/qt6
Debug 620: new_name: /usr/share/qt6
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/qt6ct
Debug 609: expanded: /usr/share/qt6ct
Debug 620: new_name: /usr/share/qt6ct
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/qt6ct
	new_name: /usr/share/qt6ct
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/sounds
Debug 609: expanded: /usr/share/sounds
Debug 620: new_name: /usr/share/sounds
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/tcl8.6
Debug 609: expanded: /usr/share/tcl8.6
Debug 620: new_name: /usr/share/tcl8.6
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/tcl8.6
	new_name: /usr/share/tcl8.6
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/tcltk
Debug 609: expanded: /usr/share/tcltk
Debug 620: new_name: /usr/share/tcltk
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/tcltk
	new_name: /usr/share/tcltk
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/terminfo
Debug 609: expanded: /usr/share/terminfo
Debug 620: new_name: /usr/share/terminfo
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/texlive
Debug 609: expanded: /usr/share/texlive
Debug 620: new_name: /usr/share/texlive
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/texlive
	new_name: /usr/share/texlive
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/texmf
Debug 609: expanded: /usr/share/texmf
Debug 620: new_name: /usr/share/texmf
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/texmf
	new_name: /usr/share/texmf
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/themes
Debug 609: expanded: /usr/share/themes
Debug 620: new_name: /usr/share/themes
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/thumbnail.so
Debug 609: expanded: /usr/share/thumbnail.so
Debug 620: new_name: /usr/share/thumbnail.so
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/thumbnail.so
	new_name: /usr/share/thumbnail.so
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/uim
Debug 609: expanded: /usr/share/uim
Debug 620: new_name: /usr/share/uim
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/uim
	new_name: /usr/share/uim
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/vulkan
Debug 609: expanded: /usr/share/vulkan
Debug 620: new_name: /usr/share/vulkan
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/X11
Debug 609: expanded: /usr/share/X11
Debug 620: new_name: /usr/share/X11
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/xml
Debug 609: expanded: /usr/share/xml
Debug 620: new_name: /usr/share/xml
Debug 630: dir: /usr/share
Debug 588: whitelist /usr/share/zenity
Debug 609: expanded: /usr/share/zenity
Debug 620: new_name: /usr/share/zenity
Debug 630: dir: /usr/share
Removed path: whitelist /usr/share/zenity
	new_name: /usr/share/zenity
	realpath: (null)
	No such file or directory
Debug 588: whitelist /usr/share/zoneinfo
Debug 609: expanded: /usr/share/zoneinfo
Debug 620: new_name: /usr/share/zoneinfo
Debug 630: dir: /usr/share
Debug 588: whitelist /var/lib/aspell
Debug 609: expanded: /var/lib/aspell
Debug 620: new_name: /var/lib/aspell
Debug 630: dir: /var
Adding whitelist top level directory /var
Removed path: whitelist /var/lib/aspell
	new_name: /var/lib/aspell
	realpath: (null)
	No such file or directory
Debug 588: whitelist /var/lib/ca-certificates
Debug 609: expanded: /var/lib/ca-certificates
Debug 620: new_name: /var/lib/ca-certificates
Debug 630: dir: /var
Removed path: whitelist /var/lib/ca-certificates
	new_name: /var/lib/ca-certificates
	realpath: (null)
	No such file or directory
Debug 588: whitelist /var/lib/dbus
Debug 609: expanded: /var/lib/dbus
Debug 620: new_name: /var/lib/dbus
Debug 630: dir: /var
Debug 588: whitelist /var/lib/menu-xdg
Debug 609: expanded: /var/lib/menu-xdg
Debug 620: new_name: /var/lib/menu-xdg
Debug 630: dir: /var
Removed path: whitelist /var/lib/menu-xdg
	new_name: /var/lib/menu-xdg
	realpath: (null)
	No such file or directory
Debug 588: whitelist /var/lib/uim
Debug 609: expanded: /var/lib/uim
Debug 620: new_name: /var/lib/uim
Debug 630: dir: /var
Removed path: whitelist /var/lib/uim
	new_name: /var/lib/uim
	realpath: (null)
	No such file or directory
Debug 588: whitelist /var/cache/fontconfig
Debug 609: expanded: /var/cache/fontconfig
Debug 620: new_name: /var/cache/fontconfig
Debug 630: dir: /var
Debug 588: whitelist /var/tmp
Debug 609: expanded: /var/tmp
Debug 620: new_name: /var/tmp
Debug 630: dir: /var
Debug 588: whitelist /var/run
Debug 609: expanded: /var/run
Debug 620: new_name: /var/run
Debug 630: dir: /var
Debug 588: whitelist /var/lock
Debug 609: expanded: /var/lock
Debug 620: new_name: /var/lock
Debug 630: dir: /var
Debug 588: whitelist /tmp/.X11-unix
Debug 609: expanded: /tmp/.X11-unix
Debug 620: new_name: /tmp/.X11-unix
Debug 630: dir: /tmp
Adding whitelist top level directory /tmp
Debug 588: whitelist /tmp/sndio
Debug 609: expanded: /tmp/sndio
Debug 620: new_name: /tmp/sndio
Debug 630: dir: /tmp
Removed path: whitelist /tmp/sndio
	new_name: /tmp/sndio
	realpath: (null)
	No such file or directory
Mounting tmpfs on /usr/share, check owner: no
1784 1731 0:106 / /usr/share rw,nosuid,nodev,noatime - tmpfs tmpfs rw,mode=755,inode64
mountid=1784 fsname=/ dir=/usr/share fstype=tmpfs
Mounting tmpfs on /run, check owner: no
1785 1707 0:107 / /run rw,nosuid,nodev,relatime - tmpfs tmpfs rw,mode=755,inode64
mountid=1785 fsname=/ dir=/run fstype=tmpfs
Whitelisting /run/user/1000
1814 1810 0:26 /firejail/firejail.ro.dir /run/user/1000/systemd ro,nosuid,nodev master:12 - tmpfs tmpfs rw,size=6431520k,nr_inodes=819200,mode=755,inode64
mountid=1814 fsname=/firejail/firejail.ro.dir dir=/run/user/1000/systemd fstype=tmpfs
Mounting tmpfs on /var, check owner: no
1815 1730 0:108 / /var rw,nosuid,nodev,noexec,noatime - tmpfs tmpfs rw,mode=755,inode64
mountid=1815 fsname=/ dir=/var fstype=tmpfs
Mounting tmpfs on /tmp, check owner: no
1816 1721 0:109 / /tmp rw,nosuid,nodev,relatime - tmpfs tmpfs rw,inode64
mountid=1816 fsname=/ dir=/tmp fstype=tmpfs
Whitelisting /usr/share/gegl-0.4
1817 1784 254:2 /usr/share/gegl-0.4 /usr/share/gegl-0.4 ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1817 fsname=/usr/share/gegl-0.4 dir=/usr/share/gegl-0.4 fstype=ext4
Whitelisting /usr/share/gimp
1818 1784 254:2 /usr/share/gimp /usr/share/gimp ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1818 fsname=/usr/share/gimp dir=/usr/share/gimp fstype=ext4
Whitelisting /usr/share/mypaint-data
1819 1784 254:2 /usr/share/mypaint-data /usr/share/mypaint-data ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1819 fsname=/usr/share/mypaint-data dir=/usr/share/mypaint-data fstype=ext4
Whitelisting /usr/share/lensfun
1820 1784 254:2 /usr/share/lensfun /usr/share/lensfun ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1820 fsname=/usr/share/lensfun dir=/usr/share/lensfun fstype=ext4
Whitelisting /run/NetworkManager/resolv.conf
1821 1785 0:26 /NetworkManager/resolv.conf /run/NetworkManager/resolv.conf rw,nosuid,nodev master:12 - tmpfs tmpfs rw,size=6431520k,nr_inodes=819200,mode=755,inode64
mountid=1821 fsname=/NetworkManager/resolv.conf dir=/run/NetworkManager/resolv.conf fstype=tmpfs
Whitelisting /run/dbus/system_bus_socket
1822 1785 0:26 /firejail/firejail.ro.file /run/dbus/system_bus_socket ro,nosuid,nodev master:12 - tmpfs tmpfs rw,size=6431520k,nr_inodes=819200,mode=755,inode64
mountid=1822 fsname=/firejail/firejail.ro.file dir=/run/dbus/system_bus_socket fstype=tmpfs
Whitelisting /run/media
1823 1785 0:26 /media /run/media rw,nosuid,nodev master:12 - tmpfs tmpfs rw,size=6431520k,nr_inodes=819200,mode=755,inode64
mountid=1823 fsname=/media dir=/run/media fstype=tmpfs
Whitelisting /run/systemd/journal/dev-log
1824 1785 0:26 /systemd/journal/dev-log /run/systemd/journal/dev-log rw,nosuid,nodev master:12 - tmpfs tmpfs rw,size=6431520k,nr_inodes=819200,mode=755,inode64
mountid=1824 fsname=/systemd/journal/dev-log dir=/run/systemd/journal/dev-log fstype=tmpfs
Whitelisting /run/systemd/journal/socket
1825 1785 0:26 /systemd/journal/socket /run/systemd/journal/socket rw,nosuid,nodev master:12 - tmpfs tmpfs rw,size=6431520k,nr_inodes=819200,mode=755,inode64
mountid=1825 fsname=/systemd/journal/socket dir=/run/systemd/journal/socket fstype=tmpfs
Whitelisting /run/systemd/resolve/resolv.conf
1826 1785 0:26 /systemd/resolve/resolv.conf /run/systemd/resolve/resolv.conf rw,nosuid,nodev master:12 - tmpfs tmpfs rw,size=6431520k,nr_inodes=819200,mode=755,inode64
mountid=1826 fsname=/systemd/resolve/resolv.conf dir=/run/systemd/resolve/resolv.conf fstype=tmpfs
Created symbolic link /run/systemd/resolve/stub-resolv.conf -> /run/systemd/resolve/resolv.conf
Whitelisting /run/udev/data
1827 1785 0:26 /udev/data /run/udev/data rw,nosuid,nodev master:12 - tmpfs tmpfs rw,size=6431520k,nr_inodes=819200,mode=755,inode64
mountid=1827 fsname=/udev/data dir=/run/udev/data fstype=tmpfs
Whitelisting /usr/share/alsa
1828 1784 254:2 /usr/share/alsa /usr/share/alsa ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1828 fsname=/usr/share/alsa dir=/usr/share/alsa fstype=ext4
Whitelisting /usr/share/applications
1829 1784 254:2 /usr/share/applications /usr/share/applications ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1829 fsname=/usr/share/applications dir=/usr/share/applications fstype=ext4
Whitelisting /usr/share/ca-certificates
1830 1784 254:2 /usr/share/ca-certificates /usr/share/ca-certificates ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1830 fsname=/usr/share/ca-certificates dir=/usr/share/ca-certificates fstype=ext4
Whitelisting /usr/share/drirc.d
1831 1784 254:2 /usr/share/drirc.d /usr/share/drirc.d ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1831 fsname=/usr/share/drirc.d dir=/usr/share/drirc.d fstype=ext4
Whitelisting /usr/share/enchant-2
1832 1784 254:2 /usr/share/enchant-2 /usr/share/enchant-2 ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1832 fsname=/usr/share/enchant-2 dir=/usr/share/enchant-2 fstype=ext4
Whitelisting /usr/share/file
1833 1784 254:2 /usr/share/file /usr/share/file ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1833 fsname=/usr/share/file dir=/usr/share/file fstype=ext4
Whitelisting /usr/share/fontconfig
1834 1784 254:2 /usr/share/fontconfig /usr/share/fontconfig ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1834 fsname=/usr/share/fontconfig dir=/usr/share/fontconfig fstype=ext4
Whitelisting /usr/share/fonts
1835 1784 254:2 /usr/share/fonts /usr/share/fonts ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1835 fsname=/usr/share/fonts dir=/usr/share/fonts fstype=ext4
Whitelisting /usr/share/gir-1.0
1836 1784 254:2 /usr/share/gir-1.0 /usr/share/gir-1.0 ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1836 fsname=/usr/share/gir-1.0 dir=/usr/share/gir-1.0 fstype=ext4
Whitelisting /usr/share/glib-2.0
1837 1784 254:2 /usr/share/glib-2.0 /usr/share/glib-2.0 ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1837 fsname=/usr/share/glib-2.0 dir=/usr/share/glib-2.0 fstype=ext4
Whitelisting /usr/share/glvnd
1838 1784 254:2 /usr/share/glvnd /usr/share/glvnd ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1838 fsname=/usr/share/glvnd dir=/usr/share/glvnd fstype=ext4
Whitelisting /usr/share/gtk-2.0
1839 1784 254:2 /usr/share/gtk-2.0 /usr/share/gtk-2.0 ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1839 fsname=/usr/share/gtk-2.0 dir=/usr/share/gtk-2.0 fstype=ext4
Whitelisting /usr/share/gtk-3.0
1840 1784 254:2 /usr/share/gtk-3.0 /usr/share/gtk-3.0 ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1840 fsname=/usr/share/gtk-3.0 dir=/usr/share/gtk-3.0 fstype=ext4
Whitelisting /usr/share/gtksourceview-4
1841 1784 254:2 /usr/share/gtksourceview-4 /usr/share/gtksourceview-4 ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1841 fsname=/usr/share/gtksourceview-4 dir=/usr/share/gtksourceview-4 fstype=ext4
Whitelisting /usr/share/hunspell
1842 1784 254:2 /usr/share/hunspell /usr/share/hunspell ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1842 fsname=/usr/share/hunspell dir=/usr/share/hunspell fstype=ext4
Whitelisting /usr/share/hwdata
1843 1784 254:2 /usr/share/hwdata /usr/share/hwdata ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1843 fsname=/usr/share/hwdata dir=/usr/share/hwdata fstype=ext4
Whitelisting /usr/share/icons
1844 1784 254:2 /usr/share/icons /usr/share/icons ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1844 fsname=/usr/share/icons dir=/usr/share/icons fstype=ext4
Whitelisting /usr/share/icu
1845 1784 254:2 /usr/share/icu /usr/share/icu ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1845 fsname=/usr/share/icu dir=/usr/share/icu fstype=ext4
Whitelisting /usr/share/kxmlgui5
1846 1784 254:2 /usr/share/kxmlgui5 /usr/share/kxmlgui5 ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1846 fsname=/usr/share/kxmlgui5 dir=/usr/share/kxmlgui5 fstype=ext4
Whitelisting /usr/share/libdrm
1847 1784 254:2 /usr/share/libdrm /usr/share/libdrm ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1847 fsname=/usr/share/libdrm dir=/usr/share/libdrm fstype=ext4
Whitelisting /usr/share/libthai
1848 1784 254:2 /usr/share/libthai /usr/share/libthai ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1848 fsname=/usr/share/libthai dir=/usr/share/libthai fstype=ext4
Whitelisting /usr/share/locale
1849 1784 254:2 /usr/share/locale /usr/share/locale ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1849 fsname=/usr/share/locale dir=/usr/share/locale fstype=ext4
Whitelisting /usr/share/mime
1850 1784 254:2 /usr/share/mime /usr/share/mime ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1850 fsname=/usr/share/mime dir=/usr/share/mime fstype=ext4
Whitelisting /usr/share/misc
1851 1784 254:2 /usr/share/misc /usr/share/misc ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1851 fsname=/usr/share/misc dir=/usr/share/misc fstype=ext4
Whitelisting /usr/share/myspell
1852 1784 254:2 /usr/share/myspell /usr/share/myspell ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1852 fsname=/usr/share/myspell dir=/usr/share/myspell fstype=ext4
Whitelisting /usr/share/p11-kit
1853 1784 254:2 /usr/share/p11-kit /usr/share/p11-kit ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1853 fsname=/usr/share/p11-kit dir=/usr/share/p11-kit fstype=ext4
Whitelisting /usr/share/perl5
1854 1784 254:2 /usr/share/perl5 /usr/share/perl5 ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1854 fsname=/usr/share/perl5 dir=/usr/share/perl5 fstype=ext4
Whitelisting /usr/share/pipewire
1855 1784 254:2 /usr/share/pipewire /usr/share/pipewire ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1855 fsname=/usr/share/pipewire dir=/usr/share/pipewire fstype=ext4
Whitelisting /usr/share/pixmaps
1856 1784 254:2 /usr/share/pixmaps /usr/share/pixmaps ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1856 fsname=/usr/share/pixmaps dir=/usr/share/pixmaps fstype=ext4
Whitelisting /usr/share/plasma
1857 1784 254:2 /usr/share/plasma /usr/share/plasma ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1857 fsname=/usr/share/plasma dir=/usr/share/plasma fstype=ext4
Whitelisting /usr/share/qt
1858 1784 254:2 /usr/share/qt /usr/share/qt ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1858 fsname=/usr/share/qt dir=/usr/share/qt fstype=ext4
Whitelisting /usr/share/qt6
1859 1784 254:2 /usr/share/qt6 /usr/share/qt6 ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=18Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
59 fsname=/usr/share/qt6 dir=/usr/share/qt6 fstype=ext4
Whitelisting /usr/share/sounds
1860 1784 254:2 /usr/share/sounds /usr/share/sounds ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1860 fsname=/usr/share/sounds dir=/usr/share/sounds fstype=ext4
Whitelisting /usr/share/terminfo
1861 1784 254:2 /usr/share/terminfo /usr/share/terminfo ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1861 fsname=/usr/share/terminfo dir=/usr/share/terminfo fstype=ext4
Whitelisting /usr/share/themes
1862 1784 254:2 /usr/share/themes /usr/share/themes ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1862 fsname=/usr/share/themes dir=/usr/share/themes fstype=ext4
Whitelisting /usr/share/vulkan
1863 1784 254:2 /usr/share/vulkan /usr/share/vulkan ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1863 fsname=/usr/share/vulkan dir=/usr/share/vulkan fstype=ext4
Whitelisting /usr/share/X11
1864 1784 254:2 /usr/share/X11 /usr/share/X11 ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1864 fsname=/usr/share/X11 dir=/usr/share/X11 fstype=ext4
Whitelisting /usr/share/xml
1865 1784 254:2 /usr/share/xml /usr/share/xml ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1865 fsname=/usr/share/xml dir=/usr/share/xml fstype=ext4
Whitelisting /usr/share/zoneinfo
1866 1784 254:2 /usr/share/zoneinfo /usr/share/zoneinfo ro,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1866 fsname=/usr/share/zoneinfo dir=/usr/share/zoneinfo fstype=ext4
Whitelisting /var/lib/dbus
1867 1815 254:2 /var/lib/dbus /var/lib/dbus ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1867 fsname=/var/lib/dbus dir=/var/lib/dbus fstype=ext4
Whitelisting /var/cache/fontconfig
1868 1815 254:2 /var/cache/fontconfig /var/cache/fontconfig ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1868 fsname=/var/cache/fontconfig dir=/var/cache/fontconfig fstype=ext4
Whitelisting /var/tmp
1869 1815 0:99 / /var/tmp rw,nosuid,nodev,noexec - tmpfs tmpfs rw,inode64
mountid=1869 fsname=/ dir=/var/tmp fstype=tmpfs
Created symbolic link /var/run -> /run
Created symbolic link /var/lock -> /run/lock
Whitelisting /tmp/.X11-unix
1870 1816 0:37 /.X11-unix /tmp/.X11-unix rw,nosuid,nodev master:22 - tmpfs tmpfs rw,nr_inodes=1048576,inode64
mountid=1870 fsname=/.X11-unix dir=/tmp/.X11-unix fstype=tmpfs
Mounting noexec /home/gcb
1871 1738 254:2 /home/gcb /home/gcb rw,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1871 fsname=/home/gcb dir=/home/gcb fstype=ext4
Directory ${DOCUMENTS} resolved as Documents
Disable /home/gcb/Documents
Directory ${PICTURES} resolved as Pictures
Directory ${DOCUMENTS} resolved as Documents
Directory ${PICTURES} resolved as Pictures
Disable /home/gcb/.local/share/Trash
Disable /home/gcb/.sqlite_history
Disable /home/gcb/.config/autostart
Disable /home/gcb/.config/plasma-workspace
Disable /etc/xdg/autostart
Mounting read-only /home/gcb/.Xauthority
1884 1871 254:2 /home/gcb/.Xauthority /home/gcb/.Xauthority ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1884 fsname=/home/gcb/.Xauthority dir=/home/gcb/.Xauthority fstype=ext4
Disable /home/gcb/.cache/konsole
Disable /home/gcb/.config/khotkeysrc
Disable /home/gcb/.config/krunnerrc
Disable /home/gcb/.config/kscreenlockerrc
Disable /home/gcb/.config/kwalletrc
Disable /home/gcb/.config/kwinrc
Disable /home/gcb/.config/kwinrulesrc
Disable /home/gcb/.config/plasma-org.kde.plasma.desktop-appletsrc
Disable /home/gcb/.config/plasmashellrc
Disable /home/gcb/.local/share/plasma
Disable /home/gcb/.local/share/plasmashell
Mounting read-only /home/gcb/.cache/ksycoca5_it_BHMNl9y_oS1QV7MRsXGKH4jEdSU=
1896 1871 254:2 /home/gcb/.cache/ksycoca5_it_BHMNl9y_oS1QV7MRsXGKH4jEdSU= /home/gcb/.cache/ksycoca5_it_BHMNl9y_oS1QV7MRsXGKH4jEdSU= ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1896 fsname=/home/gcb/.cache/ksycoca5_it_BHMNl9y_oS1QV7MRsXGKH4jEdSU= dir=/home/gcb/.cache/ksycoca5_it_BHMNl9y_oS1QV7MRsXGKH4jEdSU= fstype=ext4
Mounting read-only /home/gcb/.cache/ksycoca5_en_RJxQ2ZMz3z3hPIu5NC1rpXG9Acs=
1897 1871 254:2 /home/gcb/.cache/ksycoca5_en_RJxQ2ZMz3z3hPIu5NC1rpXG9Acs= /home/gcb/.cache/ksycoca5_en_RJxQ2ZMz3z3hPIu5NC1rpXG9Acs= ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1897 fsname=/home/gcb/.cache/ksycoca5_en_RJxQ2ZMz3z3hPIu5NC1rpXG9Acs= dir=/home/gcb/.cache/ksycoca5_en_RJxQ2ZMz3z3hPIu5NC1rpXG9Acs= fstype=ext4
Mounting read-only /home/gcb/.cache/ksycoca5_ja_BHMNl9y_oS1QV7MRsXGKH4jEdSU=
1898 1871 254:2 /home/gcb/.cache/ksycoca5_ja_BHMNl9y_oS1QV7MRsXGKH4jEdSU= /home/gcb/.cache/ksycoca5_ja_BHMNl9y_oS1QV7MRsXGKH4jEdSU= ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1898 fsname=/home/gcb/.cache/ksycoca5_ja_BHMNl9y_oS1QV7MRsXGKH4jEdSU= dir=/home/gcb/.cache/ksycoca5_ja_BHMNl9y_oS1QV7MRsXGKH4jEdSU= fstype=ext4
Mounting read-only /home/gcb/.cache/ksycoca5_en_I_wTCirE9Y7I5+SZ090U6qe55DA=
1899 1871 254:2 /home/gcb/.cache/ksycoca5_en_I_wTCirE9Y7I5+SZ090U6qe55DA= /home/gcb/.cache/ksycoca5_en_I_wTCirE9Y7I5+SZ090U6qe55DA= ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1899 fsname=/home/gcb/.cache/ksycoca5_en_I_wTCirE9Y7I5+SZ090U6qe55DA= dir=/home/gcb/.cache/ksycoca5_en_I_wTCirE9Y7I5+SZ090U6qe55DA= fstype=ext4
Mounting read-only /home/gcb/.cache/ksycoca5_en_BHMNl9y_oS1QV7MRsXGKH4jEdSU=
1900 1871 254:2 /home/gcb/.cache/ksycoca5_en_BHMNl9y_oS1QV7MRsXGKH4jEdSU= /home/gcb/.cache/ksycoca5_en_BHMNl9y_oS1QV7MRsXGKH4jEdSU= ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1900 fsname=/home/gcb/.cache/ksycoca5_en_BHMNl9y_oS1QV7MRsXGKH4jEdSU= dir=/home/gcb/.cache/ksycoca5_en_BHMNl9y_oS1QV7MRsXGKH4jEdSU= fstype=ext4
Mounting read-only /home/gcb/.config/plasma_workspace.notifyrc
1901 1871 254:2 /home/gcb/.config/plasma_workspace.notifyrc /home/gcb/.config/plasma_workspace.notifyrc ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1901 fsname=/home/gcb/.config/plasma_workspace.notifyrc dir=/home/gcb/.config/plasma_workspace.notifyrc fstype=ext4
Mounting read-only /home/gcb/.config/powerdevil.notifyrc
1902 1871 254:2 /home/gcb/.config/powerdevil.notifyrc /home/gcb/.config/powerdevil.notifyrc ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1902 fsname=/home/gcb/.config/powerdevil.notifyrc dir=/home/gcb/.config/powerdevil.notifyrc fstype=ext4
Mounting read-only /home/gcb/.config/plasmanotifyrc
1903 1871 254:2 /home/gcb/.config/plasmanotifyrc /home/gcb/.config/plasmanotifyrc ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1903 fsname=/home/gcb/.config/plasmanotifyrc dir=/home/gcb/.config/plasmanotifyrc fstype=ext4
Mounting read-only /home/gcb/.config/kdeglobals
1904 1871 254:2 /home/gcb/.config/kdeglobals /home/gcb/.config/kdeglobals ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1904 fsname=/home/gcb/.config/kdeglobals dir=/home/gcb/.config/kdeglobals fstype=ext4
Mounting read-only /home/gcb/.config/kiorc
1905 1871 254:2 /home/gcb/.config/kiorc /home/gcb/.config/kiorc ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1905 fsname=/home/gcb/.config/kiorc dir=/home/gcb/.config/kiorc fstype=ext4
Mounting read-only /home/gcb/.local/share/konsole
1906 1871 254:2 /home/gcb/.local/share/konsole /home/gcb/.local/share/konsole ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1906 fsname=/home/gcb/.local/share/konsole dir=/home/gcb/.local/share/konsole fstype=ext4
Mounting read-only /home/gcb/.config/dconf
1907 1871 254:2 /home/gcb/.config/dconf /home/gcb/.config/dconf ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1907 fsname=/home/gcb/.config/dconf dir=/home/gcb/.config/dconf fstype=ext4
Disable /usr/bin/systemctl
Disable /usr/bin/systemd-run
Disable /run/user/1000/systemd
Disable /etc/systemd/network
Disable /etc/systemd/system
Disable /home/gcb/.cache/libvirt
Disable /home/gcb/.config/libvirt
Disable /etc/anacrontab
Disable /etc/apparmor.d
Disable /etc/apparmor
Disable /etc/cron.daily
Disable /etc/cron.deny
Disable /etc/cron.hourly
Disable /etc/cron.weekly
Disable /etc/cron.d
Disable /etc/crontab
Disable /etc/cron.monthly
Disable /etc/default
Disable /etc/dkms
Disable /etc/grub.d
Disable /etc/kernel
Disable /etc/logrotate.d
Disable /etc/modules-load.d
Disable /etc/sysconfig
Disable /etc/rkhunter.conf
Mounting read-only /home/gcb/.bash_logout
1933 1871 254:2 /home/gcb/.bash_logout /home/gcb/.bash_logout ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1933 fsname=/home/gcb/.bash_logout dir=/home/gcb/.bash_logout fstype=ext4
Mounting read-only /home/gcb/.bash_profile
1934 1871 254:2 /home/gcb/.bash_profile /home/gcb/.bash_profile ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1934 fsname=/home/gcb/.bash_profile dir=/home/gcb/.bash_profile fstype=ext4
mountid=1944 fsname=/home/gcb/.config/user-dirs.locale dir=/home/gcb/.config/user-dirs.locale fstype=ext4
Mounting read-only /home/gcb/.local/share/mime
1945 1871 254:2 /home/gcb/.local/share/mime /home/gcb/.local/share/mime ro,nosuid,nodev,noexec,noatime master:1 - ext4 /dev/mapper/lvmg-arch2023 rw
mountid=1945 fsname=/home/gcb/.local/share/mime dir=/Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
home/gcb/.local/share/mime fstype=ext4
Disable /etc/group-
Disable /etc/gshadow
Disable /etc/gshadow-
Disable /etc/passwd-
Disable /etc/shadow
Disable /etc/shadow-
Disable /etc/ssh
Warning (blacklisting): cannot open /etc/ssh/*: Permission denied
Disable /home/gcb/.gnupg
Disable /home/gcb/.local/share/kwalletd
Disable /home/gcb/.local/share/pki
Disable /home/gcb/.pki
Disable /home/gcb/.ssh
Disable /usr/local/sbin
Warning (blacklisting): cannot open /usr/local/sbin/at: Permission denied
Warning (blacklisting): cannot open /usr/local/sbin/busybox: Permission denied
Warning (blacklisting): cannot open /usr/local/sbin/chage: Permission denied
Disable /usr/bin/chage
Warning (blacklisting): cannot open /usr/local/sbin/chfn: Permission denied
Disable /usr/bin/chfn
Warning (blacklisting): cannot open /usr/local/sbin/chsh: Permission denied
...

0 replies

rusty-snake · 2024-07-16T18:18:13Z

rusty-snake
Jul 16, 2024
Collaborator

XY, what are you trying? what is your goal?

1 reply

gcb Jul 18, 2024
Author

I wanted to understand why gimp had whitelisted access to /sbin at first.

But after I removed the whitelist line, then my goal was to understand why i could still access it :)

glitsj16 · 2024-07-16T20:59:56Z

glitsj16
Jul 16, 2024
Collaborator

I've updated my gimp.profile and commented out these two lines:
(at first i tried adding blacklist lines to my .local, when that didn't seem to work I edited the .profile)
# See issue #4367, gimp 2.10.22-3: gegl:introspect broken
#noblacklist /sbin
#noblacklist /usr/sbin

If you want to override these in a gimp.local, use:

$ cat ~/.config/firejail/gimp.local
ignore noblacklist /sbin
ignore noblacklist /usr/sbin

1 reply

gcb Jul 18, 2024
Author

oh ignore noblacklist i see. I was using blacklist on the .local

OK, with ignore noblacklist it works. But I'm still confused why completely removing the noblacklist from the .profile did not block /sbin/.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

How to blacklist /sbin and /usr/sbin? #6410

{{title}}

Replies: 3 comments 2 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

How to blacklist /sbin and /usr/sbin? #6410

gcb Jul 16, 2024

Replies: 3 comments · 2 replies

gcb Jul 16, 2024 Author

rusty-snake Jul 16, 2024 Collaborator

gcb Jul 18, 2024 Author

glitsj16 Jul 16, 2024 Collaborator

gcb Jul 18, 2024 Author

gcb
Jul 16, 2024

Replies: 3 comments 2 replies

gcb
Jul 16, 2024
Author

rusty-snake
Jul 16, 2024
Collaborator

gcb Jul 18, 2024
Author

glitsj16
Jul 16, 2024
Collaborator

gcb Jul 18, 2024
Author