JAILCHECK(1)

📦
version 0.9.82.2 · 10 versions
, in arch rolling

💅 JAILCHECK — like, the manual page for jailcheck(1), bestie ✨

okay so real talk: this is the man page for jailcheck, and it's genuinely one of those little tools that eats. let's get into it 🫶

🌸 NAME 🌸

jailcheck — a simple utility program to test running sandboxes. that's it, that's the whole vibe check 🎀

✨ SYNOPSIS ✨

sudo jailcheck [OPTIONS] [directory]

💖 DESCRIPTION 💖

so here's the tea: jailcheck attaches itself to all the sandboxes that were started by the user, and then it runs a bunch of basic tests on the sandbox filesystem. it's giving inspector energy, honestly 👑

here's the checklist it goes through, in order:

  1. Virtual directories jailcheck pulls out a list of all the main virtual directories that are installed by the sandbox. these directories get built by firejail at startup using the --private* and --whitelist commands. iconic behavior tbh 🦋
  2. Noexec test jailcheck drops executable programs into /home/username, /tmp, and /var/tmp, then tries to actually run them from inside the sandbox — so basically it's testing whether that directory is executable or not. sneaky but valid 💀
  3. Read access test jailcheck creates test files in whatever directories the user specified, and then tries to read them from inside the sandbox. little peekaboo moment 🙈
  4. AppArmor test
  5. Seccomp test
  6. Networking test
💡 the program should be started using sudo or doas. no cap, it needs the privileges.

🎀 OPTIONS 🎀

  • --debug — prints debug messages. for when you need the lore 🔍
  • -?, --help — prints the options and dips out. classic ✨
  • --version — prints the program version and exits. slay, short and sweet 💅
  • [directory] — one or more directories in the user home to test for read access. ~/.ssh and ~/.gnupg are tested by default, because of course they are 🍓

🌈 OUTPUT 🌈

for each sandbox it detects, we print this line right here:

PID:USER:Sandbox Name:Command

and then it's followed by the relevant sandbox information — stuff like the virtual directories and various warnings. the receipts, basically 🧾

🔥 EXAMPLE 🔥

$ sudo jailcheck
2014:netblue::firejail /usr/bin/gimp
   Virtual dirs: /tmp, /var/tmp, /dev, /usr/share,
   Warning: I can run programs in /home/netblue
   Networking: disabled

2055:netblue::firejail /usr/bin/ssh -X netblue@x.y.z.net
   Virtual dirs: /var/tmp, /dev, /usr/share, /run/user/1000,
   Warning: I can read ~/.ssh
   Networking: enabled

2186:netblue:libreoffice:firejail --appimage
/opt/LibreOffice-fresh.appimage
   Virtual dirs: /tmp, /var/tmp, /dev,
   Networking: enabled

26090:netblue::/usr/bin/firejail /opt/firefox/firefox
   Virtual dirs: /home/netblue, /tmp, /var/tmp, /dev, /etc, /usr/share,
                 /run/user/1000,
   Networking: enabled

26160:netblue:tor:firejail --private=~/tor-browser_en-US ./start-tor
   Warning: AppArmor not enabled
   Virtual dirs: /home/netblue, /tmp, /var/tmp, /dev, /etc, /bin,
                 /usr/share, /run/user/1000,
   Warning: I can run programs in /home/netblue
   Networking: enabled

like, look at all those warnings. the tool is literally telling on itself and i respect it 😭

👑 LICENSE 👑

this program is free software — you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. fr fr, that's the deal 📜

Homepage: https://firejail.wordpress.com — go say hi 🌐

🫶 SEE ALSO 🫶

firejail(1), firemon(1), firecfg(1), firejail-profile(5), firejail-login(5), firejail-users(5),

that's the whole page, bestie — hope it slayed 💜 and just so you know, this was version 0.9.82.2, dated Nov 2026 🌸 mwah, go check your sandboxes ✨

📦 where this page comes from