whitelist + private logic changed after #4229

[rusty-snake]

File-system layout:

$ ls ~/foo
bar
baz

Before #4229 firejail --shell=none --whitelist=~/baz --private=~/foo ~/bar had executed ~/foo/bar with ~/foo as private $HOME and the --whitelist=~/baz was ignored (meaning whitelisting wasn't enabled).

After #4229 you need to add --whitelist=~/bar. Otherwise you get Error: no suitable ~/bar executable found.

That's what I found out so far. I'm not 100% sure if this are the right STR. I'm also not sure if this behaviour is maybe better then the old, as it seems whitelist was ignored previously.

[smitsohu]

I thought nobody would notice 😄

It was a conscious decision to keep things a bit more simple, but of course the old behaviour can be added back.

[smitsohu]

IIRC another reason why I did it like this is because it avoids creating a special case for the user home directory. All other private options can be combined freely with whitelist, also before #4229. It seemed advantageous to me to keep it like that because it enabled a workaround for missing subdirectory support in private-etc (now implemented), private-home, and so on.

That said, private and private= do something different than the other private options, and combining them with whitelist doesn't really make much sense.

[smitsohu]

@rusty-snake Nevermind, I'll add it back so it behaves as before.

[rusty-snake]

I create this issues because I'm wasn't sure if this was intentionally or a mistake. Maybe it's better to have whitelist working in --private=shared_private_home. Some complex setups maybe need to be adjusted, however users with such setups can do this IMHO if we add it to the RELONTES:

[rusty-snake]

4909fa7#diff-6698244f9a67e5c8ae5c03806df74f6d9f1ae1b31ad6176eb09e136f07f3dad9 whitelists all files in $HOME by default (you can ignore this profile_add IIRC). This still means that a program can not save files (e.g. documents/pictures or configs/caches) in files/dirs that don't exists when the sandbox is started (and mkdir still don't work with private).

[netblue30]

4909fa7

I was looking for a quick and dirty fix for tor browser, and somehow it got checked in with something else. I took it out, and put the disable whitelist functionality back.

a2b81da