github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-21 06:45:29 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 1

profiles: ssh: add ${RUNUSER}/gvfsd-sftp (#6479)

Browse source 
Based on the report by @Saren-Arterius[1]:

Since GNOME gvfs 1.53+, the ssh client options `ControlMaster=auto` and
`ControlPath=/run/user/$UID/gvfsd-sftp/%C` are used to mount sftp.

Since `/run/user/$UID/gvfsd-sftp` is not whitelisted, gvfs sftp mount
with nautilus will fail with a meaningless error message shown in the
UI.

Steps to reproduce[1]:

Prepare ssh server or localhost, then run:

    ssh -o"ForwardX11 no" -o"ForwardAgent no" \
        -o"PermitLocalCommand no" -o"ClearAllForwardings yes" \
        -o"NoHostAuthenticationForLocalhost yes" \
        -o"ControlMaster auto" \
        -o"ControlPath=/run/user/${UID}/gvfsd-sftp/test" \
        -s {SSH_HOST} sftp

stderr shows:

    unix_listener: cannot bind to path /run/user/$UID/gvfsd-sftp/test.{RANDOM_STRING}: No such file or directory

And ssh exits with error code 255.

Fixes #5816.

[1] https://github.com/netblue30/firejail/issues/5816#issue-1695295931

Reported-by: @Saren-Arterius
Suggested-by: @Saren-Arterius
Reported-by: @Alex-Farol
Reported-by: @mirko
This commit is contained in:
Kelvin M. Klann 2024-09-19 10:55:35 +00:00 • committed by GitHub
parent 3bbc6b59e1
commit 271fb1bfc7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 1 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
etc/profile-m-z/ssh.profile
View file

@ -21,6 +21,7 @@ include disable-programs.inc
whitelist ${RUNUSER}/gcr/ssh
whitelist ${RUNUSER}/gnupg/*/S.gpg-agent.ssh # custom gpg homedir setup
whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh # default gpg homedir setup
whitelist ${RUNUSER}/gvfsd-sftp
whitelist ${RUNUSER}/keyring/ssh
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc