github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #178] How to use Unbound profile #125

New issue

Closed

opened 2026-05-05 05:06:39 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 05:06:39 -06:00

Owner

Originally created by @rogshdo on GitHub (Nov 29, 2015).
Original GitHub issue: https://github.com/netblue30/firejail/issues/178

Whenever I try to jail Unbound, the jail shuts down within a few seconds of launching.

# firejail /usr/bin/unbound -d
Reading profile /etc/firejail/unbound.profile
Reading profile /etc/firejail/disable-mgmt.inc
Parent pid 7266, child pid 7267
The new log directory is /proc/7267/root/var/log
Child process initialized

parent is shutting down, bye...

I am running firejail 0.9.34 but have grabbed the unbound.profile from current git. Should I try to launch the jail in some other way or do I just need to wait for the 0.9.35 release?

Originally created by @rogshdo on GitHub (Nov 29, 2015). Original GitHub issue: https://github.com/netblue30/firejail/issues/178 Whenever I try to jail Unbound, the jail shuts down within a few seconds of launching. ``` # firejail /usr/bin/unbound -d Reading profile /etc/firejail/unbound.profile Reading profile /etc/firejail/disable-mgmt.inc Parent pid 7266, child pid 7267 The new log directory is /proc/7267/root/var/log Child process initialized parent is shutting down, bye... ``` I am running firejail 0.9.34 but have grabbed the unbound.profile from current git. Should I try to launch the jail in some other way or do I just need to wait for the 0.9.35 release?

gitea-mirror

2026-05-05 05:06:39 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:06:48 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 30, 2015):

I have an unbound profile in the master branch. A release will probably come in the next few days, or you can get what I have now and compile it. I usually start unbound as:

# firejail /usr/sbin/unbound -d
Reading profile /etc/firejail/unbound.profile
Reading profile /etc/firejail/disable-mgmt.inc
Parent pid 8209, child pid 8210
The new log directory is /proc/8210/root/var/log
Child process initialized

If is not starting, you'll need to check the system log to see what is going on. On Debian/Ubuntu, syslog is in /var/log/syslog. I usually keep an xterm open running "sudo tail -f /var/log/syslog" when playing with servers.

@netblue30 commented on GitHub (Nov 30, 2015): I have an unbound profile in the master branch. A release will probably come in the next few days, or you can get what I have now and compile it. I usually start unbound as: ``` # firejail /usr/sbin/unbound -d Reading profile /etc/firejail/unbound.profile Reading profile /etc/firejail/disable-mgmt.inc Parent pid 8209, child pid 8210 The new log directory is /proc/8210/root/var/log Child process initialized ``` If is not starting, you'll need to check the system log to see what is going on. On Debian/Ubuntu, syslog is in /var/log/syslog. I usually keep an xterm open running "sudo tail -f /var/log/syslog" when playing with servers.

gitea-mirror commented

2026-05-05 05:06:51 -06:00

Author

Owner

@rogshdo commented on GitHub (Nov 30, 2015):

I turned up verbosity's logging level so I get more output now. When I launch unbound, everything is fine until I make a dns query (in this example I ping google.com).

# firejail unbound -d
Reading profile /etc/firejail/unbound.profile
Reading profile /etc/firejail/disable-mgmt.inc
Parent pid 22924, child pid 22925
The new log directory is /proc/22925/root/var/log
Child process initialized
[1448912574] unbound[1:0] warning: unbound is already running as pid 1.
[1448912574] unbound[1:0] debug: chdir to /etc/unbound
[1448912574] unbound[1:0] debug: chroot to /etc/unbound
[1448912574] unbound[1:0] debug: drop user privileges, run as unbound
[1448912574] unbound[1:0] debug: switching log to /etc/unbound/unbound.log
[1448912574] unbound[1:0] error: Could not open logfile /unbound.log: Read-only file system
[1448912574] unbound[1:0] debug: module config: "validator iterator"
[1448912574] unbound[1:0] notice: init module 0: validator
[1448912574] unbound[1:0] notice: init module 1: iterator
[1448912574] unbound[1:0] debug: target fetch policy for level 0 is 3
[1448912574] unbound[1:0] debug: target fetch policy for level 1 is 2
[1448912574] unbound[1:0] debug: target fetch policy for level 2 is 1
[1448912574] unbound[1:0] debug: target fetch policy for level 3 is 0
[1448912574] unbound[1:0] debug: target fetch policy for level 4 is 0
[1448912574] unbound[1:0] debug: Forward zone server list:
[1448912574] unbound[1:0] info: DelegationPoint<.>: 0 names (0 missing), 3 addrs (0 result, 3 avail) parentNS
[1448912574] unbound[1:0] debug: Reading root hints from /root.hints
[1448912574] unbound[1:0] info: DelegationPoint<.>: 13 names (2 missing), 24 addrs (0 result, 24 avail) parentNS
[1448912574] unbound[1:0] debug: cache memory msg=66072 rrset=66072 infra=2632 val=66344
[1448912574] unbound[1:0] info: start of service (unbound 1.5.6).
[1448912580] unbound[1:0] debug: validator[module 0] operate: extstate:module_state_initial event:module_event_new
[1448912580] unbound[1:0] info: validator operate: query google.com. A IN
[1448912580] unbound[1:0] debug: iterator[module 1] operate: extstate:module_state_initial event:module_event_pass
[1448912580] unbound[1:0] info: resolving google.com. A IN
[1448912580] unbound[1:0] info: processQueryTargets: google.com. A IN
[1448912580] unbound[1:0] info: sending query: google.com. A IN
[1448912580] unbound[1:0] debug: sending to target: <.> 205.171.3.25#53
[1448912580] unbound[1:0] debug: cache memory msg=66072 rrset=66072 infra=2929 val=66344
[1448912580] unbound[1:0] debug: iterator[module 1] operate: extstate:module_wait_reply event:module_event_reply
[1448912580] unbound[1:0] info: iterator operate: query google.com. A IN
[1448912580] unbound[1:0] info: response for google.com. A IN
[1448912580] unbound[1:0] info: reply from <.> 205.171.3.25#53
[1448912580] unbound[1:0] info: query response was ANSWER
[1448912580] unbound[1:0] info: finishing processing for google.com. A IN
[1448912580] unbound[1:0] debug: validator[module 0] operate: extstate:module_wait_module event:module_event_moddone
[1448912580] unbound[1:0] info: validator operate: query google.com. A IN
[1448912580] unbound[1:0] info: prime trust anchor
[1448912580] unbound[1:0] debug: validator[module 0] operate: extstate:module_state_initial event:module_event_pass
[1448912580] unbound[1:0] info: validator operate: query . DNSKEY IN
[1448912580] unbound[1:0] debug: iterator[module 1] operate: extstate:module_state_initial event:module_event_pass
[1448912580] unbound[1:0] info: resolving . DNSKEY IN
[1448912580] unbound[1:0] info: processQueryTargets: . DNSKEY IN
[1448912580] unbound[1:0] info: sending query: . DNSKEY IN
[1448912580] unbound[1:0] debug: sending to target: <.> 74.82.42.42#53
[1448912580] unbound[1:0] debug: cache memory msg=66308 rrset=66306 infra=3226 val=66344
[1448912580] unbound[1:0] debug: iterator[module 1] operate: extstate:module_wait_reply event:module_event_reply
[1448912580] unbound[1:0] info: iterator operate: query . DNSKEY IN
[1448912580] unbound[1:0] info: response for . DNSKEY IN
[1448912580] unbound[1:0] info: reply from <.> 74.82.42.42#53
[1448912580] unbound[1:0] info: query response was ANSWER
[1448912580] unbound[1:0] info: finishing processing for . DNSKEY IN
[1448912580] unbound[1:0] debug: validator[module 0] operate: extstate:module_wait_module event:module_event_moddone
[1448912580] unbound[1:0] info: validator operate: query . DNSKEY IN
[1448912580] unbound[1:0] fatal error: could not open autotrust file for writing, /keys/dnssec-root-anchor.key.1-0: Read-only file system

parent is shutting down, bye...

The DNSSEC anchor key is in /etc/unbound. Here is the relevant part of my unbound.conf:

server:
   ...
    auto-trust-anchor-file: "/etc/unbound/keys/dnssec-root-anchor.key"
   ...

I don't know why the error is complaining aoubt /keys/dnssec-root-anchor.key.1-0 when the key is at /etc/unbound/keys/dnssec-root-anchor.key. Any idea?

@rogshdo commented on GitHub (Nov 30, 2015): I turned up verbosity's logging level so I get more output now. When I launch unbound, everything is fine until I make a dns query (in this example I `ping google.com`). ``` # firejail unbound -d Reading profile /etc/firejail/unbound.profile Reading profile /etc/firejail/disable-mgmt.inc Parent pid 22924, child pid 22925 The new log directory is /proc/22925/root/var/log Child process initialized [1448912574] unbound[1:0] warning: unbound is already running as pid 1. [1448912574] unbound[1:0] debug: chdir to /etc/unbound [1448912574] unbound[1:0] debug: chroot to /etc/unbound [1448912574] unbound[1:0] debug: drop user privileges, run as unbound [1448912574] unbound[1:0] debug: switching log to /etc/unbound/unbound.log [1448912574] unbound[1:0] error: Could not open logfile /unbound.log: Read-only file system [1448912574] unbound[1:0] debug: module config: "validator iterator" [1448912574] unbound[1:0] notice: init module 0: validator [1448912574] unbound[1:0] notice: init module 1: iterator [1448912574] unbound[1:0] debug: target fetch policy for level 0 is 3 [1448912574] unbound[1:0] debug: target fetch policy for level 1 is 2 [1448912574] unbound[1:0] debug: target fetch policy for level 2 is 1 [1448912574] unbound[1:0] debug: target fetch policy for level 3 is 0 [1448912574] unbound[1:0] debug: target fetch policy for level 4 is 0 [1448912574] unbound[1:0] debug: Forward zone server list: [1448912574] unbound[1:0] info: DelegationPoint<.>: 0 names (0 missing), 3 addrs (0 result, 3 avail) parentNS [1448912574] unbound[1:0] debug: Reading root hints from /root.hints [1448912574] unbound[1:0] info: DelegationPoint<.>: 13 names (2 missing), 24 addrs (0 result, 24 avail) parentNS [1448912574] unbound[1:0] debug: cache memory msg=66072 rrset=66072 infra=2632 val=66344 [1448912574] unbound[1:0] info: start of service (unbound 1.5.6). [1448912580] unbound[1:0] debug: validator[module 0] operate: extstate:module_state_initial event:module_event_new [1448912580] unbound[1:0] info: validator operate: query google.com. A IN [1448912580] unbound[1:0] debug: iterator[module 1] operate: extstate:module_state_initial event:module_event_pass [1448912580] unbound[1:0] info: resolving google.com. A IN [1448912580] unbound[1:0] info: processQueryTargets: google.com. A IN [1448912580] unbound[1:0] info: sending query: google.com. A IN [1448912580] unbound[1:0] debug: sending to target: <.> 205.171.3.25#53 [1448912580] unbound[1:0] debug: cache memory msg=66072 rrset=66072 infra=2929 val=66344 [1448912580] unbound[1:0] debug: iterator[module 1] operate: extstate:module_wait_reply event:module_event_reply [1448912580] unbound[1:0] info: iterator operate: query google.com. A IN [1448912580] unbound[1:0] info: response for google.com. A IN [1448912580] unbound[1:0] info: reply from <.> 205.171.3.25#53 [1448912580] unbound[1:0] info: query response was ANSWER [1448912580] unbound[1:0] info: finishing processing for google.com. A IN [1448912580] unbound[1:0] debug: validator[module 0] operate: extstate:module_wait_module event:module_event_moddone [1448912580] unbound[1:0] info: validator operate: query google.com. A IN [1448912580] unbound[1:0] info: prime trust anchor [1448912580] unbound[1:0] debug: validator[module 0] operate: extstate:module_state_initial event:module_event_pass [1448912580] unbound[1:0] info: validator operate: query . DNSKEY IN [1448912580] unbound[1:0] debug: iterator[module 1] operate: extstate:module_state_initial event:module_event_pass [1448912580] unbound[1:0] info: resolving . DNSKEY IN [1448912580] unbound[1:0] info: processQueryTargets: . DNSKEY IN [1448912580] unbound[1:0] info: sending query: . DNSKEY IN [1448912580] unbound[1:0] debug: sending to target: <.> 74.82.42.42#53 [1448912580] unbound[1:0] debug: cache memory msg=66308 rrset=66306 infra=3226 val=66344 [1448912580] unbound[1:0] debug: iterator[module 1] operate: extstate:module_wait_reply event:module_event_reply [1448912580] unbound[1:0] info: iterator operate: query . DNSKEY IN [1448912580] unbound[1:0] info: response for . DNSKEY IN [1448912580] unbound[1:0] info: reply from <.> 74.82.42.42#53 [1448912580] unbound[1:0] info: query response was ANSWER [1448912580] unbound[1:0] info: finishing processing for . DNSKEY IN [1448912580] unbound[1:0] debug: validator[module 0] operate: extstate:module_wait_module event:module_event_moddone [1448912580] unbound[1:0] info: validator operate: query . DNSKEY IN [1448912580] unbound[1:0] fatal error: could not open autotrust file for writing, /keys/dnssec-root-anchor.key.1-0: Read-only file system parent is shutting down, bye... ``` The DNSSEC anchor key is in /etc/unbound. Here is the relevant part of my unbound.conf: ``` server: ... auto-trust-anchor-file: "/etc/unbound/keys/dnssec-root-anchor.key" ... ``` I don't know why the error is complaining aoubt `/keys/dnssec-root-anchor.key.1-0` when the key is at `/etc/unbound/keys/dnssec-root-anchor.key`. Any idea?

gitea-mirror commented

2026-05-05 05:06:54 -06:00

Author

Owner

@netblue30 commented on GitHub (Dec 1, 2015):

I think I know what the problem is: the following directories are mounted read-only by the sandbox: /bin, /sbin, /lib, /lib64, /usr, /etc, and /var.

I would move dnssec-root-anchor.key inside /run directory. They already have over there an unbound.pid file. Usually under /etc you have configuration files that cannot be modified by the application. Things that are changing usually go under /run.

@netblue30 commented on GitHub (Dec 1, 2015): I think I know what the problem is: the following directories are mounted read-only by the sandbox: /bin, /sbin, /lib, /lib64, /usr, /etc, and /var. I would move dnssec-root-anchor.key inside /run directory. They already have over there an unbound.pid file. Usually under /etc you have configuration files that cannot be modified by the application. Things that are changing usually go under /run.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#125

No description provided.

Rows
Columns