github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1621] NetworkManager DNS update overrides --dns option #1085

New issue

Closed

opened 2026-05-05 07:26:03 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 07:26:03 -06:00

Owner

Originally created by @matthew-nichols on GitHub (Oct 28, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1621

If you run firejail --dns=8.8.8.8 you create a jail with that DNS info. If you then cause NetworkManager to update DNS information (i.e., (dis)connect from WiFi/Ethernet/VPN) the jail will now have the resolv.conf from NetworkManager, not from the --dns option.

On my system (Debian 9, KDE) /etc/resolv.conf is a symbolic link to /var/run/NetworkManager/resolv.conf (/var/run is a symbolic link to /run/).

Running sudo firejail --dns=8.8.8.8 --noprofile creates a mount namespace with a tmpfs on /run/NetworkManager/resolv.conf. If you then edit /run/NetworkManger/resolv.conf in the default namespace with vi (which does an atomic replace that changes the inode, which NetworkManager appears to do) the jail loses that tmpfs mount (mount | grep resolv.conf). If you edit with nano the same does not happen.

My firejail version is that from the Debian repositories, 0.9.44.8. I also tried it with the version from backports, 0.9.50, and this behavior appears there as well.

Originally created by @matthew-nichols on GitHub (Oct 28, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1621 If you run `firejail --dns=8.8.8.8` you create a jail with that DNS info. If you then cause NetworkManager to update DNS information (i.e., (dis)connect from WiFi/Ethernet/VPN) the jail will now have the `resolv.conf` from NetworkManager, not from the `--dns` option. On my system (Debian 9, KDE) `/etc/resolv.conf` is a symbolic link to `/var/run/NetworkManager/resolv.conf` (`/var/run` is a symbolic link to `/run/`). Running `sudo firejail --dns=8.8.8.8 --noprofile` creates a mount namespace with a tmpfs on `/run/NetworkManager/resolv.conf`. If you then edit `/run/NetworkManger/resolv.conf` in the default namespace with vi (which does an atomic replace that changes the inode, which NetworkManager appears to do) the jail loses that tmpfs mount (`mount | grep resolv.conf`). If you edit with nano the same does not happen. My firejail version is that from the Debian repositories, 0.9.44.8. I also tried it with the version from backports, 0.9.50, and this behavior appears there as well.

gitea-mirror

2026-05-05 07:26:03 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 07:26:07 -06:00

Author

Owner

@netblue30 commented on GitHub (Oct 29, 2017):

I've been able to reproduce it on Debian 9. In vim you need to set:

:set backupcopy=no

before saving the file. nano, echo command and anything else does not generate the problem. I'll have to look what exactly vim does. Thanks for the bug!

@netblue30 commented on GitHub (Oct 29, 2017): I've been able to reproduce it on Debian 9. In vim you need to set: ````` :set backupcopy=no ````` before saving the file. nano, echo command and anything else does not generate the problem. I'll have to look what exactly vim does. Thanks for the bug!

gitea-mirror commented

2026-05-05 07:26:08 -06:00

Author

Owner

@matthew-nichols commented on GitHub (Oct 29, 2017):

vim (and NetworkManager) writes a file with a slightly different name and then rename's over the old file. If you change settings in NetworkManager (say, disconnect or reconnect) you will see the inode number change.

@matthew-nichols commented on GitHub (Oct 29, 2017): vim (and NetworkManager) writes a file with a slightly different name and then rename's over the old file. If you change settings in NetworkManager (say, disconnect or reconnect) you will see the inode number change.

gitea-mirror commented

2026-05-05 07:26:10 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 1, 2017):

Fixed, let me know if there are still problems.

@netblue30 commented on GitHub (Nov 1, 2017): Fixed, let me know if there are still problems.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1085

No description provided.

Rows
Columns