qbittorrent: cannot access files in /run/media

[MrHerlockSholmes]

I run firejail in a Manjaro KDE Plasma desktop PC. I want to use firejail to sandbox qbittorrent, however, I am having a problem with granting access to a specific HDD, instead of unrestricted access to /mnt and /media as the "Firejail Configuration" app appears to provide as a sole option. In fact, I would ideally like to give it access to only a specific folder in a specific hard drive, for example, something like give qbittorrent access to for example "/dev/sdc/downloads" only.

My PC has several HDDs, all of them formatted as Ext4 except for one, formatted as an NTFS drive (/dev/sdc), the one I want to target. I have tried to edit the qbittorrent.profile by adding a line such as "whitelist /dev/sdc" or launching qbittorrent from the command line as "firejail --writable=/dev/sdc qbittorrent" or "firejail --whitelist=/dev/sdc qbittorrent", but nothing seems to work. The only way I can get to run qbittorrent under firejail and have access to the drive in question is by using the "Firejail Configuration Wizard", select a "Build a custom security profile" and deselect "Restrict /mnt and /media", but that gives qbittorrent unrestricted access to all drives, something that appears to defeat the whole purpose of firejailing and I do not want to do.

Can anyone provide some suggestions on how to achieve this?

Thanking all in advance for any help.

[kmk3]

@MrHerlockSholmes on Aug 29:

I run firejail in a Manjaro KDE Plasma desktop PC. I want to use firejail to
sandbox qbittorrent, however, I am having a problem with granting access to a
specific HDD, instead of unrestricted access to /mnt and /media as the
"Firejail Configuration" app appears to provide as a sole option. In fact, I
would ideally like to give it access to only a specific folder in a specific
hard drive, for example, something like give qbittorrent access to for
example "/dev/sdc/downloads" only.

/dev/sdX are block devices; usually normal users cannot write to them directly
(though --private-dev can be used for additional hardening) and AFAIK
qbittorrent can't use them directly anyway. Normally block devices have to be
mounted somewhere before accessing their contents (unless you're using
something like partitioning tools).

Assuming that /dev/sdc is mounted at /mnt/foo and that only /mnt/foo/downloads
should be accessible, whitelisting the latter path is the usual way to do so.
This should make only /mnt/foo/downloads visible under /mnt:

$ sudo mkdir -p /mnt/foo/downloads /mnt/foo/secret /mnt/bar/secret
$ find /mnt/foo /mnt/bar
/mnt/foo
/mnt/foo/downloads
/mnt/foo/secret
/mnt/bar
/mnt/bar/secret
$ firejail --noprofile --quiet --whitelist=/mnt/foo/downloads find /mnt
/mnt
/mnt/foo
/mnt/foo/downloads

So try adding something like the following to e.g.:
/etc/firejail/qbittorrent.local

whitelist /mnt/foo/downloads

[MrHerlockSholmes]

Thank you so much for all the info provided, kmk3. I am running into an issue trying to implement your suggestion, as follows:

My tower PC has one SSD running the O/S (Manjaro Plasma), and seven (7) HDDs, as follows:

• Four HDDs set up as Veracrypt volumes
• Two HDDs, formatted as EXT4, unencrypted and
• One HDD, formatted as NTFS, also unencrypted - this is the one I would like to grant qbittorrent access to

However, when I run the command "ls -l /mnt" in a console box, the only drives listed are the four Veracrypt volumes, none of the EXT4 or NTFS drives are listed, so, I find myself unable to implement the suggestion at this point. Any suggestions on how I get around this?

Again, thanks a bunch for your help.

[kmk3]

@MrHerlockSholmes on Aug 30:

Thank you so much for all the info provided, kmk3.

No problem.

I am running into an issue trying to implement your suggestion, as follows:

My tower PC has one SSD running the O/S (Manjaro Plasma), and seven (7) HDDs,
as follows:

• Four HDDs set up as Veracrypt volumes
• Two HDDs, formatted as EXT4, unencrypted and
• One HDD, formatted as NTFS, also unencrypted - this is the one I would like
  to grant qbittorrent access to

However, when I run the command "ls -l /mnt" in a console box, the only
drives listed are the four Veracrypt volumes, none of the EXT4 or NTFS drives
are listed, so, I find myself unable to implement the suggestion at this
point. Any suggestions on how I get around this?

Again, thanks a bunch for your help.

Usually, drives/partitions aren't mounted automatically by default on Linux, at
least on the distros/DEs that I've used.

To mount /dev/sdc at /mnt/foo:

sudo mount /dev/sdc /mnt/foo

If /mnt/foo contains what you'd expect, then you can add an entry on /etc/fstab
to auto-mount it by default. You could use /dev/sdc directly in it, but the
order of sdX drives is not guaranteed to always be the same, so it's better to
use UUID (filesystem id), PARTUUID (partition id) or LABEL instead (see
findfs(8) for details). Any should work; I'll use UUID in the
example as I think that's the most common.

To show the known ids for all drives, use blkid or lsblk --fs. Assuming
that you get an output of "UUID=123" for /dev/sdc, add the following to
/etc/fstab:

UUID=123  /mnt/foo  ntfs  rw  0 2

Note: The above is mostly equivalent to mount -t ntfs -o rw /dev/sdc /mnt/foo.

Then run mount -a to mount everything on /etc/fstab, or just reboot.

See mount(8) and fstab(5) for more options.

See also:

• https://wiki.archlinux.org/title/File_systems#Mount_a_file_system
• https://wiki.archlinux.org/title/Fstab
• https://wiki.archlinux.org/title/Persistent_block_device_naming

---

By the way, usually partition tables are created on drives (with e.g.:
fdisk), then individual partitions (with e.g.: fdisk), then the filesystems
(with e.g.: mkfs.ext4). So I'd expect files to live on /dev/sdc1, /dev/sdc2
and so on. But creating the filesystem directly on /dev/sdX also works I
suppose.

[MrHerlockSholmes]

I would like to try what you suggest, however, before I do so, I'd like you to know that while /mnt only lists the four veracrypt partitions, my KDE Plasma file manager (Dolphin) does list all seven HDDs as already mounted and all seven are fully accessible after booting the PC, without the need for me to issue a mount command. In particular, the NTFS formatted HDD is listed as "NTFSVol" (the name I gave it when I formatted the HDD) by Dolphin, and when, using Dolphin, I right-click on this drive and select properties, I see the following:

Mounted from: /dev/sdc1
Mounted on: /run/media/Herlock/531C2F3F17265DA5 (Herlock's my user name)

Having already created a folder named "Downloads" in this HDD, I had tried to insert a "whitelist" line in qbittorrent.profile, as follows:

I first tried:

whitelist /run/media/Herlock/531C2F3F17265DA5/Downloads

and when that did not work, I then tried

whitelist ${HOME}/531C2F3F17265DA5/Downloads (as other whitelist lines in the profile file are worded this way)

which proved equally unsuccessful. This is puzzling.

[kmk3]

I would like to try what you suggest, however, before I do so, I'd like you
to know that while /mnt only lists the four veracrypt partitions, my KDE
Plasma file manager (Dolphin) does list all seven HDDs as already mounted and
all seven are fully accessible after booting the PC, without the need for me
to issue a mount command.

Dolphin does indeed list the available partitions and it can mount them, though
I believe that auto-mounting the partitions is not the default behavior (unless
it's a Manjaro-specific patch or something). But if they are actually
auto-mounted, then indeed there is no need to also mount them under /mnt. Just
make sure that the partitions you need are already mounted (by running e.g.:
lsblk --fs) before running firejail, or they won't show up in the sandbox.

In particular, the NTFS formatted HDD is listed as "NTFSVol" (the name I gave
it when I formatted the HDD) by Dolphin, and when, using Dolphin, I
right-click on this drive and select properties, I see the following:

Mounted from: /dev/sdc1 Mounted on: /run/media/Herlock/531C2F3F17265DA5
(Herlock's my user name)

Having already created a folder named "Downloads" in this HDD, I had tried to
insert a "whitelist" line in qbittorrent.profile, as follows:

I first tried:

whitelist /run/media/Herlock/531C2F3F17265DA5/Downloads

and when that did not work

Interesting, the command looks like it should work. What exactly does not
work? Are you unable to access that path in firejail or are you able to access
paths which should be unavailable?

If the former, then what is the output of the following?

dir=/run/media/Herlock/531C2F3F17265DA5/Downloads
firejail --noprofile --quiet --whitelist="$dir" touch "$dir" && echo yes

If the latter, then note that if you have any other whitelist command that
affects any of the parent paths, more paths may be exposed. For example:

whitelist /run/media

With the above, everything under /run/media will be made visible. Note that
such command appears on whitelist-run-common.inc, which is not included on
qbittorrent.profile by default, but it might be in the future.

For good measure, try to also add the following to your qbittorrent.profile:

ignore whitelist /run/media

Considering that whitelist-run-common.inc could be later included on other
profiles as well and if you don't want most programs to have access to those 4
veracrypt partitions, you could put the above on globals.local. Then, for each
profile that should have access to them, add whitelist /run/media to
$profile.local, which should take precedence over globals.local.

You could also blacklist them globally and only allow them when needed. In
that case, put the following on globals.local:

blacklist /run/media/Herlock/111
blacklist /run/media/Herlock/222
blacklist /run/media/Herlock/333
blacklist /run/media/Herlock/444

Then, on any profiles that should have access to them:

noblacklist /run/media/Herlock/111
noblacklist /run/media/Herlock/222
noblacklist /run/media/Herlock/333
noblacklist /run/media/Herlock/444

Though note that this could be bypassed by accessing them through e.g.: dbus
rather than by path directly, so that's another thing to keep in mind.

Besides the above, ultimately I think it would be better to always mount under
e.g.: /mnt the paths which shouldn't be visible by default, or at least try to
avoid mounting them under /run. I don't know if/how that could be done in
Dolphin though.

I then tried

whitelist ${HOME}/531C2F3F17265DA5/Downloads (as other whitelist lines in
the profile file are worded this way)

which proved equally unsuccessful. This is puzzling.

${HOME} usually expands to /home/USER, so if your home is under
/home/Herlock, unless there is something mounted on
/home/Herlock/531C2F3F17265DA5, this will not work.

[MrHerlockSholmes]

Running lsblk --fs does show all seven HDDs mounted at boot time, I could also see there that "531C2F3F17265DA5" is the NTFS HDD's UUID. I gotta delve into what you mention in your last message, to see if I can find the reason why this is not working, unfortunately, I'll be away a day or two, will post my results when I return.

Thanks!!

[MrHerlockSholmes]

I’ve tried working through your instructions above, however, this is getting progressively difficult for me, as I am most definitely not a power user. I was even unable to locate the file “globals.local” anywhere in my system. However, I was successfully able to launch qbittorrent from the command line with the following command:

firejail --noprofile --whitelist=/run/media/Herlock/531C2F3F17265DA5/Downloads qbittorrent

So, my question is, would the above way of launching qbittorrent delinquently sandbox this application?

Thanks

(see results of my globals.local below)

[MrHerlockSholmes]

kmk3,

I ran the commands you listed in your latest message, the results are shown below. A comment here, you listed:

firejail --ignore=private-bin --include=/etc/firejail/allow-bin-sh.inc \
and
--profile=qbittorrent \

in two separate lines, I assumed this was just one single command as:

firejail --ignore=private-bin --include=/etc/firejail/allow-bin-sh.inc \ --profile=qbittorrent \

Having said that, this is what I got:

[Herlock@Herlock-pc ~]$ firejail --ignore=private-bin --include=/etc/firejail/allow-bin-sh.inc \  --profile=qbittorrent \

> sh -c 'ls -l /run/media /run/media/Herlock /run/media/Herlock/531C2F3F17265DA5/Downloads'
Reading profile /etc/firejail/allow-bin-sh.inc
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc

** Note: you can use --noprofile to disable default.profile **

Parent pid 8767, child pid 8768
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: cleaning all supplementary groups
Child process initialized in 62.57 ms
/bin/bash: line 1:  : command not found

Parent is shutting down, bye…

[Herlock@Herlock-pc ~]$

---

Edit by @kmk3: Formatting.

[kmk3]

@MrHerlockSholmes on Sep 5:

kmk3,

I ran the commands you listed in your latest message, the results are shown
below. A comment here, you listed:

firejail --ignore=private-bin --include=/etc/firejail/allow-bin-sh.inc \
and
--profile=qbittorrent \

in two separate lines, I assumed this was just one single command as:

firejail --ignore=private-bin --include=/etc/firejail/allow-bin-sh.inc \ --profile=qbittorrent \

That code block is all meant to be a single invocation, including the third
line; I just broke it into multiple lines to make it more readable.

Having said that, this is what I got:

[Herlock@Herlock-pc ~]$ firejail --ignore=private-bin --include=/etc/firejail/allow-bin-sh.inc \  --profile=qbittorrent \

> sh -c 'ls -l /run/media /run/media/Herlock /run/media/Herlock/531C2F3F17265DA5/Downloads'
Reading profile /etc/firejail/allow-bin-sh.inc
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc

** Note: you can use --noprofile to disable default.profile **

Parent pid 8767, child pid 8768
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: cleaning all supplementary groups
Child process initialized in 62.57 ms
/bin/bash: line 1:  : command not found

Parent is shutting down, bye…

[Herlock@Herlock-pc ~]$

Considering these lines:

Reading profile /etc/firejail/default.profile
/bin/bash: line 1:  : command not found

I don't know how the bash error happened, but the qbittorrent profile is not
being applied. Try running it again all in one line:

firejail --ignore=private-bin --include=/etc/firejail/allow-bin-sh.inc --profile=qbittorrent sh -c 'ls -l /run/media /run/media/Herlock /run/media/Herlock/531C2F3F17265DA5/Downloads'

And also the second code block in one line:

firejail --ignore=private-bin --include=/etc/firejail/allow-bin-sh.inc --profile=qbittorrent /bin/bash

[MrHerlockSholmes]

kmk3,

Thanks for the patience you are having with me, and sorry for incorrectly running the command.
This time, I ran the command as a single line:

firejail --ignore=private-bin --include=/etc/firejail/allow-bin-sh.inc --profile=qbittorrent sh -c 'ls -l /run/media /run/media/Herlock /run/media/Herlock/531C2F3F17265DA5/Downloads'

The results are very clear, as follows:

For /run/media, it returned the following, which shows no access granted, exactly as I desired:

Child process initialized in 160.52 ms

/run/media:
total 0
drwxr-xr-x 3 nobody nobody 60 Sep 10 08:37 Herlock

For /run/media/Herlock, it returned the following, which shows no access granted, exactly as I desired:

/run/media/Herlock:
total 0
drwxr-xr-x 3 nobody nobody 60 Sep 10 08:37 531C2F3F17265DA5

And finally, for /run/media/Herlock/531C2F3F17265DA5/Downloads, it shows full access, exactly as I wanted:

/run/media/Herlock/531C2F3F17265DA5/Downloads:
total 26608

and down here there's a long, detailed list of bittorrent download folders that had been created when running qbittorrent without firejail sandboxing.

Thus, it appears that the whitelist line I entered in /etc/firejail/qbittorrent.profile, which is:

whitelist /run/media/Herlock/531C2F3F17265DA5/Downloads

is in fact granting access to the desired folder in the desired HDD.

However, when I launch qbittorrent from the command line, with any of the the following commands:

$ firejail qbittorrent

or

$ firejail --profile=qbittorrent qbittorrent

or even

$ firejail --profile=/etc/firejail/qbittorrent.profile qbittorrent

QbitTorrent is blocked from accessing the desired location.

This is maddening.

---

Edit by @kmk3: Formatting

[kmk3]

@MrHerlockSholmes on Sep 10:

kmk3,

Thanks for the patience you are having with me, and sorry for incorrectly
running the command.

No problem. By the way, I've formatted your comment to make it more readable
(click on "..." -> "Edit" to see the source). The main feature that helps
readability is to put code inside triple backticks. Example:

```
whitelist foo
```

Rendered:

whitelist foo

When you have the time, please see GitHub's markdown guide:

• https://docs.github.com/en/github/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#quoting-code

For more details, there is the commonmark spec:

• https://spec.commonmark.org/0.30/

[...]

And finally, for /run/media/Herlock/531C2F3F17265DA5/Downloads, it shows full
access, exactly as I wanted:

/run/media/Herlock/531C2F3F17265DA5/Downloads:
total 26608

and down here there's a long, detailed list of bittorrent download folders
that had been created when running qbittorrent without firejail sandboxing.

Thus, it appears that the whitelist line I entered in
/etc/firejail/qbittorrent.profile, which is:

whitelist /run/media/Herlock/531C2F3F17265DA5/Downloads

is in fact granting access to the desired folder in the desired HDD.

However, when I launch qbittorrent from the command line, with any of the the
following commands:

[...]

or even

$ firejail --profile=/etc/firejail/qbittorrent.profile qbittorrent

QbitTorrent is blocked from accessing the desired location.

This is maddening.

How exactly are you trying to access these paths?

If it's through the file picker, maybe it tries to access mounted paths through
dbus (which is blocked on qbittorrent.profile), such as with xdg-desktop-portal
or something similar.

What happens if you enter exactly /run/media/Herlock/531C2F3F17265DA5/Downloads
in the location bar when selecting a file?

[MrHerlockSholmes]

kmk3,

Trying to firejail qbittorrent in my Manjaro KDE desktop is proving to be an unmitigated disaster, so, I am throwing in the towel.
Just to document my very latest, and definitely last attempt, when I launch qbittorrent with the following command:

firejail --profile=/etc/firejail/qbittorrent.profile qbittorrent

I get a slew of errors in the console terminal, some (just a very few), shown below. QbitTorrent does launch, but, as stated in an earlier message, does not show any of the bittorrent folders previously created in the desired folder, all it shows is a blank screen (I've inserted a screenshot). Then, when, within the qBitTorrent app I click on the “+ Open” button, a file manager opens, which shows access only to my /home/Herlock folder, located in my system's SSD drive, and nothing else. Zero access to any of the PC's HDDs or even to the folder I specifically whitelisted in the qbittorrent profile.

Going back to the errors and messages I see displayed in the console terminal, some of these are as follows:

Warning: cleaning all supplementary groups 
Warning: Cannot confine the application using AppArmor. 
Maybe firejail-default AppArmor profile is not loaded into the kernel. 
As root, run "aa-enforce firejail-default" to load it.

I exited the firejail session and tried to do as advised above, with the following results:

$sudo aa-enforce firejail-default
Setting /etc/apparmor.d/firejail-default to enforce mode.

ERROR: Cache read/write disabled: interface file missing. (Kernel needs AppArmor 2.4 compatibility patch.)
Warning: unable to find a suitable fs in /proc/mounts, is it mounted?
Use --subdomainfs to override.

There appears to be a neverending number of issues that need to be corrected, with no end in sight.

Anywho, additional messages and errors I saw displayed in the firejail qbittorrent session are as follows:

kf.notifications: env says KDE is running but SNI unavailable -- check KDE_FULL_SESSION and XDG_CURRENT_DESKTOP 
kf.coreaddons: no metadata found in "/usr/lib/qt/plugins/kf5/kio/desktop.so" "Failed to extract plugin meta data from '/usr/lib/qt/plugins/kf5/kio/desktop.so'" 
kf.coreaddons: no metadata found in "/usr/lib/qt/plugins/kf5/kio/applications.so" "Failed to extract plugin meta data from '/usr/lib/qt/plugins/kf5/kio/applications.so'" 
kf.coreaddons: no metadata found in "/usr/lib/qt/plugins/kf5/kio/desktop.so" "Failed to extract plugin meta data from '/usr/lib/qt/plugins/kf5/kio/desktop.so'" 
kf.coreaddons: no metadata found in "/usr/lib/qt/plugins/kf5/kio/applications.so" "Failed to extract plugin meta data from '/usr/lib/qt/plugins/kf5/kio/applications.so'" 
kf.solid.backends.udisks2: Failed enumerating UDisks2 objects: "org.freedesktop.DBus.Error.Disconnected"
"Not connected to D-Bus server" 
kf.solid.backends.udisks2: Failed enumerating UDisks2 objects: "org.freedesktop.DBus.Error.Disconnected"
"Not connected to D-Bus server"

etc., etc., etc., ad nauseam, it never ends.

I am truly sorry I made you waste so much of your time, but this is beyond me.

Thanks.