github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

profiles: fix allowing netcat (#7059)

Browse source 
disable-common.inc has these lines:

    blacklist ${PATH}/nc
    blacklist ${PATH}/nc.openbsd
    blacklist ${PATH}/nc.traditional
    blacklist ${PATH}/ncat

With openbsd-netcat on Artix, `/usr/bin/nc.openbsd` is symlinked to
`/usr/bin/nc`:

    $ pacman -Fl gnu-netcat openbsd-netcat | grep bin/nc
    gnu-netcat usr/bin/nc
    openbsd-netcat usr/bin/nc
    openbsd-netcat usr/bin/nc.openbsd
    $ realpath /usr/bin/nc.openbsd
    /usr/bin/nc

So `noblacklist ${PATH}/nc` is not enough, as
`blacklist ${PATH}/nc.openbsd` will follow the symlink to `/usr/bin/nc`
and still blacklist it.

To prevent `/usr/bin/nc` from being blacklisted,
`noblacklist ${PATH}/nc.openbsd` is also needed in this case.

To ensure that netcat is allowed, always `noblacklist` all netcat paths.

Fixes #6911.
This commit is contained in:
Kelvin M. Klann 2026-02-11 19:14:21 +00:00 • committed by GitHub
parent e31d872a51
commit e46d9adcf1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
etc/profile-m-z/playonlinux.profile
View file

@ -11,6 +11,9 @@ noblacklist ${HOME}/.PlayOnLinux
# nc is needed to run playonlinux
noblacklist ${PATH}/nc
noblacklist ${PATH}/nc.openbsd
noblacklist ${PATH}/nc.traditional
noblacklist ${PATH}/ncat
# Allow perl (blacklisted by disable-interpreters.inc)
include allow-perl.inc

2
etc/profile-m-z/ssh.profile
View file

@ -9,6 +9,8 @@ include globals.local
# nc can be used as ProxyCommand, e.g. when using tor
noblacklist ${PATH}/nc
noblacklist ${PATH}/nc.openbsd
noblacklist ${PATH}/nc.traditional
noblacklist ${PATH}/ncat
# Allow ssh (blacklisted by disable-common.inc)