How to compile with overlayfs support?

[TheBjoel2]

So, I wanted to run this

$ firejail --overlay-tmpfs zsh

but then it told me this

Error: invalid --overlay-tmpfs command line option

Upon investigation, I've discovered that my firejail build may have been compiled without overlayfs support

$ firejail --version
firejail version 0.9.72

Compile time support:
        - always force nonewprivs support is disabled
        - AppArmor support is enabled
        - AppImage support is enabled
        - chroot support is enabled
        - D-BUS proxy support is enabled
        - file transfer support is enabled
        - firetunnel support is disabled
        - IDS support is disabled
        - networking support is enabled
        - output logging is enabled
        - overlayfs support is disabled         <<<< Look here
        - private-home support is enabled
        - private-cache and tmpfs as user enabled
        - SELinux support is disabled
        - user namespace support is enabled
        - X11 sandboxing support is enabled

But how can I enable overlayfs support?

[rusty-snake]

Is is disabled because of known security vulnerabilities.

If you want to ignore this, you can patch configure.ac to enable it.

[TheBjoel2]

Is there another way to make changes to a filesystem temporary?

[rusty-snake]

Well you can create a copy. Firejail has --private-home for the home directory. If you habe an CoW filesystem lile XFS vor Btrfs, cp --reflink=auto is blazing fast because it does not copy the actual data.

[kmk3]

Relates to:

• CVE-2021-26910 and `--overlay-tmpfs` #4178