Firejail does not restrict access to –tmpfs, which allows local users to gain privileges, as demonstrated by mounting over /etc.