Is there a reason for blacklist and whitelist to be combined in some profiles?

[powerjungle]

Some examples:
https://github.com/netblue30/firejail/blob/49d21b074042020054cfe17fb22ca580b92bd20b/etc/profile-m-z/wget.profile
https://github.com/netblue30/firejail/blob/49d21b074042020054cfe17fb22ca580b92bd20b/etc/profile-a-l/firefox.profile

Once you use one, using also the other in the same profile seems pointless and confusing.

Relates to:

• docs: improve whitelist and blacklist descriptions in man pages #6622

[rusty-snake]

Wget: The whitelisting and the blacklisting are done is different path hierarchies.
Firefox: Its complicated. It's a mix of being actually usefulnl, historically grown and defense-in-depth.

[powerjungle]

Okay but, if you whitelist a path, all other paths are not allowed anyway, right? Doesn't matter where you whitelist it or what "feature" it's related to.

[rusty-snake]

if you whitelist a path, all other paths [in the same whitelist base] are not allowed anyway, right?

Yes

[powerjungle]

What do you mean "in the same whitelist base"?

[rusty-snake]

top directory

[powerjungle]

I made a pull request, which should help with clarity:

• docs: improve whitelist and blacklist descriptions in man pages #6622

What I'm also thinking is that the Arch Wiki should also probably be edited:

• https://wiki.archlinux.org/index.php?title=Firejail&oldid=817847#Whitelists_and_blacklists