github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

#1028

New issue

Closed

opened 2026-05-05 07:19:35 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 07:19:35 -06:00

Owner

Originally created by @jelford on GitHub (Sep 10, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1543

I'm running on a freshly installed copy of Fedora 26 (Workstation). I haven't made any modifications to the default ssh settings. I installed firejail (from master), along with running firecfg, and I found I was unable to pull my latest source from GitHub with an SSH remote. I have a work-around, but it involves changing my system-wide SSH settings.

What happens:

~/s/firejail> git pull myremote
Bad owner or permissions on /etc/ssh/ssh_config.d/05-redhat.conf
fatal: Could not read from remote repository.
~/s/firejail> ssh git@github.com
Bad owner or permissions on /etc/ssh/ssh_config.d/05-redhat.conf

It looks like SSH will bomb out if its config files don't belong to either the current user or root (22376d27a3/readconf.c (L1727)).

In the firejail sandbox, with the default profile for ssh:

~/s/firejail> firejail --profile=/usr/local/etc/firejail/ssh.profile stat /etc/ssh/ssh_config.d/05-redhat.conf
  File: /etc/ssh/ssh_config.d/05-redhat.conf
  Size: 690       	Blocks: 8          IO Block: 4096   regular file
Device: fd01h/64769d	Inode: 3540822     Links: 1
Access: (0644/-rw-r--r--)  Uid: (65534/  nobody)   Gid: (65534/  nobody)
...

So it looks like the default SSH profile will prevent it from running when there's system-wide configuration under /etc/ssh/ssh_config.d/. I can work around for now by just deleting the file - it doesn't have anything I actually want anyway.

I looked to update the SSH profile, but I couldn't see a way to pull in system files with their ownership intact. I'm happy to do a PR if there's a profile instruction I've missed.

Originally created by @jelford on GitHub (Sep 10, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1543 I'm running on a freshly installed copy of Fedora 26 (Workstation). I haven't made any modifications to the default ssh settings. I installed firejail (from master), along with running firecfg, and I found I was unable to pull my latest source from GitHub with an SSH remote. I have a work-around, but it involves changing my system-wide SSH settings. What happens: ``` ~/s/firejail> git pull myremote Bad owner or permissions on /etc/ssh/ssh_config.d/05-redhat.conf fatal: Could not read from remote repository. ~/s/firejail> ssh git@github.com Bad owner or permissions on /etc/ssh/ssh_config.d/05-redhat.conf ``` It looks like SSH will bomb out if its config files don't belong to either the current user or root (https://github.com/openssh/openssh-portable/blob/22376d27a349f62c502fec3396dfe0fdcb2a40b7/readconf.c#L1727). In the firejail sandbox, with the default profile for ssh: ``` ~/s/firejail> firejail --profile=/usr/local/etc/firejail/ssh.profile stat /etc/ssh/ssh_config.d/05-redhat.conf File: /etc/ssh/ssh_config.d/05-redhat.conf Size: 690 Blocks: 8 IO Block: 4096 regular file Device: fd01h/64769d Inode: 3540822 Links: 1 Access: (0644/-rw-r--r--) Uid: (65534/ nobody) Gid: (65534/ nobody) ... ``` So it looks like the default SSH profile will prevent it from running when there's system-wide configuration under `/etc/ssh/ssh_config.d/`. I can work around for now by just deleting the file - it doesn't have anything I actually want anyway. I looked to update the SSH profile, but I couldn't see a way to pull in system files with their ownership intact. I'm happy to do a PR if there's a profile instruction I've missed.

gitea-mirror

2026-05-05 07:19:35 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 07:19:40 -06:00

Author

Owner

@netblue30 commented on GitHub (Sep 13, 2017):

Uid: (65534/ nobody) Gid: (65534/ nobody)

This comes from the user namespace. In /etc/firejail/ssh.profile comment out noroot line (add a #) like this:

nodvd
nogroups
nonewprivs
#noroot
nosound
notv

I'll bring in a fix for the profile on mainline git, thanks for the bug.

@netblue30 commented on GitHub (Sep 13, 2017): > Uid: (65534/ nobody) Gid: (65534/ nobody) This comes from the user namespace. In /etc/firejail/ssh.profile comment out noroot line (add a #) like this: ````` nodvd nogroups nonewprivs #noroot nosound notv ````` I'll bring in a fix for the profile on mainline git, thanks for the bug.

gitea-mirror commented

2026-05-05 07:19:41 -06:00

Author

Owner

@jelford commented on GitHub (Sep 17, 2017):

Thanks @netblue30 , that works for me.

@jelford commented on GitHub (Sep 17, 2017): Thanks @netblue30 , that works for me.

gitea-mirror commented

2026-05-05 07:19:42 -06:00

Author

Owner

@cremesk commented on GitHub (Dec 23, 2017):

Dez 23 14:46:56 t1703.naschwerk.mysec-home.net audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-coredump@90-19339-0 comm="systemd" exe="/usr/lib/systemd/systemd" hostnam$
Dez 23 14:46:57 t1703.naschwerk.mysec-home.net systemd-coredump[19340]: Process 19336 (ssh) of user 1000 dumped core.

                                                                    Stack trace of thread 3:
                                                                    #0  0x00007f400ff05b29 syscall (libc.so.6)
                                                                    #1  0x00007f400f33c741 keyctl (libkeyutils.so.1)
                                                                    #2  0x00007f40106476ca get_collection (libkrb5.so.3)
                                                                    #3  0x00007f401064929d krcc_ptcursor_new (libkrb5.so.3)
                                                                    #4  0x00007f401063e2e8 krb5_cccol_cursor_next (libkrb5.so.3)
                                                                    #5  0x00007f401063e73a krb5_cccol_have_content (libkrb5.so.3)
                                                                    #6  0x00007f4010917e76 acquire_cred_context.isra.9 (libgssapi_krb5.so.2)
                                                                    #7  0x00007f4010918041 acquire_cred.isra.10 (libgssapi_krb5.so.2)
                                                                    #8  0x00007f401091818c krb5_gss_acquire_cred (libgssapi_krb5.so.2)
                                                                    #9  0x00007f401091b233 kg_get_defcred (libgssapi_krb5.so.2)
                                                                    #10 0x00007f401091ff70 krb5_gss_init_sec_context_ext (libgssapi_krb5.so.2)
                                                                    #11 0x00007f4010920ff2 krb5_gss_init_sec_context (libgssapi_krb5.so.2)
                                                                    #12 0x00007f401090a811 gss_init_sec_context (libgssapi_krb5.so.2)
                                                                    #13 0x000055e9f96c7c8f ssh_gssapi_init_ctx (ssh)
                                                                    #14 0x000055e9f96c7f75 ssh_gssapi_check_mechanism (ssh)
                                                                    #15 0x000055e9f96955bf userauth_gssapi (ssh)
                                                                    #16 0x000055e9f9696be3 userauth (ssh)
                                                                    #17 0x000055e9f9696d25 input_userauth_failure (ssh)
                                                                    #18 0x000055e9f96bea2a ssh_dispatch_run (ssh)
                                                                    #19 0x000055e9f96bead9 ssh_dispatch_run_fatal (ssh)
                                                                    #20 0x000055e9f969655a ssh_userauth2 (ssh)
                                                                    #21 0x000055e9f9692543 ssh_login (ssh)
                                                                    #22 0x000055e9f9683285 main (ssh)
                                                                    #23 0x00007f400fe1500a __libc_start_main (libc.so.6)
                                                                    #24 0x000055e9f9684caa _start (ssh)

@cremesk commented on GitHub (Dec 23, 2017): Dez 23 14:46:56 t1703.naschwerk.mysec-home.net audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-coredump@90-19339-0 comm="systemd" exe="/usr/lib/systemd/systemd" hostnam$ Dez 23 14:46:57 t1703.naschwerk.mysec-home.net systemd-coredump[19340]: Process 19336 (ssh) of user 1000 dumped core. Stack trace of thread 3: #0 0x00007f400ff05b29 syscall (libc.so.6) #1 0x00007f400f33c741 keyctl (libkeyutils.so.1) #2 0x00007f40106476ca get_collection (libkrb5.so.3) #3 0x00007f401064929d krcc_ptcursor_new (libkrb5.so.3) #4 0x00007f401063e2e8 krb5_cccol_cursor_next (libkrb5.so.3) #5 0x00007f401063e73a krb5_cccol_have_content (libkrb5.so.3) #6 0x00007f4010917e76 acquire_cred_context.isra.9 (libgssapi_krb5.so.2) #7 0x00007f4010918041 acquire_cred.isra.10 (libgssapi_krb5.so.2) #8 0x00007f401091818c krb5_gss_acquire_cred (libgssapi_krb5.so.2) #9 0x00007f401091b233 kg_get_defcred (libgssapi_krb5.so.2) #10 0x00007f401091ff70 krb5_gss_init_sec_context_ext (libgssapi_krb5.so.2) #11 0x00007f4010920ff2 krb5_gss_init_sec_context (libgssapi_krb5.so.2) #12 0x00007f401090a811 gss_init_sec_context (libgssapi_krb5.so.2) #13 0x000055e9f96c7c8f ssh_gssapi_init_ctx (ssh) #14 0x000055e9f96c7f75 ssh_gssapi_check_mechanism (ssh) #15 0x000055e9f96955bf userauth_gssapi (ssh) #16 0x000055e9f9696be3 userauth (ssh) #17 0x000055e9f9696d25 input_userauth_failure (ssh) #18 0x000055e9f96bea2a ssh_dispatch_run (ssh) #19 0x000055e9f96bead9 ssh_dispatch_run_fatal (ssh) #20 0x000055e9f969655a ssh_userauth2 (ssh) #21 0x000055e9f9692543 ssh_login (ssh) #22 0x000055e9f9683285 main (ssh) #23 0x00007f400fe1500a __libc_start_main (libc.so.6) #24 0x000055e9f9684caa _start (ssh)

gitea-mirror commented

2026-05-05 07:19:43 -06:00

Author

Owner

@felixwiemuth commented on GitHub (Oct 14, 2024):

It seems this happens again (here with Manjaro):

$ git push
Bad owner or permissions on /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

Probably as /etc/firejail/git.profile has noroot.
Adding ignore noroot to ~/.config/firejail/git.local resolves the problem.

@felixwiemuth commented on GitHub (Oct 14, 2024): It seems this happens again (here with Manjaro): ``` $ git push Bad owner or permissions on /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. ``` Probably as `/etc/firejail/git.profile` has `noroot`. Adding `ignore noroot` to `~/.config/firejail/git.local` resolves the problem.

gitea-mirror commented

2026-05-05 07:19:45 -06:00

Author

Owner

@powerman commented on GitHub (Jul 16, 2025):

It's sad we can't use noroot because of this. 😞

@powerman commented on GitHub (Jul 16, 2025): It's sad we can't use `noroot` because of this. 😞

gitea-mirror referenced this issue

2026-05-05 10:13:39 -06:00

[PR #1854] [MERGED] add --noautopulse arg for complex pulse setups #4094

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1028

No description provided.

Rows
Columns