{"action":"created","issue":{"url":"https://api.github.com/repos/netblue30/firejail/issues/278","repository_url":"https://api.github.com/repos/netblue30/firejail","labels_url":"https://api.github.com/repos/netblue30/firejail/issues/278/labels{/name}","comments_url":"https://api.github.com/repos/netblue30/firejail/issues/278/comments","events_url":"https://api.github.com/repos/netblue30/firejail/issues/278/events","html_url":"https://github.com/netblue30/firejail/issues/278","id":131289062,"number":278,"title":"unexpected behaviour of whitelist on filesystem different from the one of $HOME","user":{"login":"wcat","id":3199053,"avatar_url":"https://avatars.githubusercontent.com/u/3199053?v=3","gravatar_id":"","url":"https://api.github.com/users/wcat","html_url":"https://github.com/wcat","followers_url":"https://api.github.com/users/wcat/followers","following_url":"https://api.github.com/users/wcat/following{/other_user}","gists_url":"https://api.github.com/users/wcat/gists{/gist_id}","starred_url":"https://api.github.com/users/wcat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wcat/subscriptions","organizations_url":"https://api.github.com/users/wcat/orgs","repos_url":"https://api.github.com/users/wcat/repos","events_url":"https://api.github.com/users/wcat/events{/privacy}","received_events_url":"https://api.github.com/users/wcat/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-02-04T09:28:16Z","updated_at":"2016-02-05T07:59:37Z","closed_at":null,"body":"I think this is not the expected behaviour (/media/data is the mount point of a filesystem that I mount on boot):\r\n\r\n`touch /media/data/some-file /media/data/foo/some-file`\r\n`firejail --blacklist=/media/data find / -name some-file 2> /dev/null`\r\nno file is found\r\n`firejail ---blacklist=/media/data --whitelist=/media/data/some-dir find / -name some-file 2> /dev/null`\r\nfinds: /run/firejail/mnt/orig-media/data/some-file and /run/firejail/mnt/orig-media/data/foo/some-file\r\n\r\nBasically if I whitelist something on /media/data then everything is accessible.\r\n\r\nfirejail version: 0.9.36\r\nos: Fedora 23 x86_64"},"comment":{"url":"https://api.github.com/repos/netblue30/firejail/issues/comments/180242896","html_url":"https://github.com/netblue30/firejail/issues/278#issuecomment-180242896","issue_url":"https://api.github.com/repos/netblue30/firejail/issues/278","id":180242896,"user":{"login":"wcat","id":3199053,"avatar_url":"https://avatars.githubusercontent.com/u/3199053?v=3","gravatar_id":"","url":"https://api.github.com/users/wcat","html_url":"https://github.com/wcat","followers_url":"https://api.github.com/users/wcat/followers","following_url":"https://api.github.com/users/wcat/following{/other_user}","gists_url":"https://api.github.com/users/wcat/gists{/gist_id}","starred_url":"https://api.github.com/users/wcat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wcat/subscriptions","organizations_url":"https://api.github.com/users/wcat/orgs","repos_url":"https://api.github.com/users/wcat/repos","events_url":"https://api.github.com/users/wcat/events{/privacy}","received_events_url":"https://api.github.com/users/wcat/received_events","type":"User","site_admin":false},"created_at":"2016-02-05T07:59:37Z","updated_at":"2016-02-05T07:59:37Z","body":"ok by using only --whitelist it works as expected (only /media/data/some-dir  is visible). \r\n\r\nBlacklisting a directory and then whitelisting a directory (or file) inside it leads to different behaviors on my system:\r\n- on $HOME everything is blacklisted and I can't see any file.\r\n- on some other mount point (I've tried on /media/data and /data) whitelisting any file (or directory) completely remove the effects of the blacklisting. If possible I think that firejail in this situation should at least fail with some error message instead of whitelisting everything. Even if this is a misuse of firejail it could leads to a security problem if someone do this by mistake and didn't notice what have just happened."}}