Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Officially deprecate follow-symlink-as-user #4305

Closed
2 tasks
kmk3 opened this issue May 24, 2021 · 1 comment
Closed
2 tasks

Officially deprecate follow-symlink-as-user #4305

kmk3 opened this issue May 24, 2021 · 1 comment

Comments

@kmk3
Copy link
Collaborator

kmk3 commented May 24, 2021

@smitsohu commented 23 days ago:

For now all restrictions regarding symbolic links are gone (and
follow-symlink-as-user from firejail.config is without effect). I'm not
entirely sure if that is sustainable, but it can always be added back.

(I don't know if you're working on it, so I'm creating a task for it just to
make sure that it's not lost to time etc)

From what I gather it was removed on commit 5445d87 ("add support for
arbitrary whitelist directories") / PR #4229, and from looking at the code:

$ git show --pretty='%h %ai %s' -s master
518633eb4 2021-05-24 15:51:55 +0200 fix firejail startup race
$ git grep follow-symlink-as-user
RELNOTES:  * feature: follow-symlink-as-user runtime config option in
etc/firejail.config:# follow-symlink-as-user yes
src/firejail/checkcfg.c:                        PARSE_YESNO(CFG_FOLLOW_SYMLINK_AS_USER, "follow-symlink-as-user")
test/root/checkcfg.exp:send --  "echo \"follow-symlink-as-user yes\" >> /etc/firejail/firejail.config\r"
test/root/firejail.config:follow-symlink-as-user no
$ git grep CFG_FOLLOW_SYMLINK_AS_USER
src/firejail/checkcfg.c:                        PARSE_YESNO(CFG_FOLLOW_SYMLINK_AS_USER, "follow-symlink-as-user")
src/firejail/firejail.h:        CFG_FOLLOW_SYMLINK_AS_USER,

It seems that it's effectively deprecated/only there to keep existing configs
working (which I appreciate). So I'd suggest this:

  • Mention that it's deprecated/gone on the release notes

And maybe this:

  • Warn that it has no effect if found on firejail.config
@netblue30
Copy link
Owner

All done, thanks!

4909fa7

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants