github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1981] Apparmor dbus confinement not working? #1332

New issue

Closed

opened 2026-05-05 07:52:58 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 07:52:58 -06:00

Owner

Originally created by @chiraag-nataraj on GitHub (Jun 6, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1981

There's some weird stuff going on with apparmor and firejail. I've enabled apparmor in the firejail profile and am using the default firejail-default apparmor profile (which should block dbus). However, opening up a sandboxed terminal and using dbus-monitor works just fine.

At this point, I wanted to confirm that x-terminal-emulator (the program in question) was being restricted by apparmor, so I ran sudo aa-status, which gave me this. I then looked at the output of firejail --tree (to figure out which process I was looking for), which gave me this. As you can see, PID 32525 is being confined by apparmor. When I run dbus-monitor in the terminal, I get this in my journal:

Jun 06 18:36:40 chiraag dbus-daemon[13572]: [session uid=1000 pid=13572] Connection :1.325 (uid=1000 pid=4274 comm="") became a monitor.

However, it seems some stuff is still being blocked. For example, I also get lines like:

Jun 06 18:52:48 chiraag audit[10256]: AVC apparmor="DENIED" operation="file_lock" profile="firejail-default" name="/run/utmp" pid=10256 comm="x-terminal-emul" requested_mask="k" denied_mask="k" fsuid=1000 ouid=0

So it seems that dbus is still working even though apparmor is supposed to be blocking it. My profile also blocks all network connections (net none) and my dbus is using regular Unix sockets.

~~Even more mysteriously, using apparmor with firefox seems to work. That is, firefox dbus connections are blocked.~~ Never mind. Those are an unrelated error. I'm not getting any firefox dbus warnings in my journal.

My x-terminal-emulator profile is here.

Originally created by @chiraag-nataraj on GitHub (Jun 6, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1981 There's some weird stuff going on with apparmor and firejail. I've enabled `apparmor` in the firejail profile and am using the default `firejail-default` apparmor profile (which should block dbus). However, opening up a sandboxed terminal and using `dbus-monitor` works just fine. At this point, I wanted to confirm that `x-terminal-emulator` (the program in question) was being restricted by `apparmor`, so I ran `sudo aa-status`, which gave me [this](https://github.com/netblue30/firejail/files/2078363/aa-status.txt). I then looked at the output of `firejail --tree` (to figure out which process I was looking for), which gave me [this](https://github.com/netblue30/firejail/files/2078368/firejail-tree.txt). As you can see, PID 32525 is being confined by apparmor. When I run `dbus-monitor` in the terminal, I get this in my journal: ``` Jun 06 18:36:40 chiraag dbus-daemon[13572]: [session uid=1000 pid=13572] Connection :1.325 (uid=1000 pid=4274 comm="") became a monitor. ``` However, it seems _some_ stuff is still being blocked. For example, I also get lines like: ``` Jun 06 18:52:48 chiraag audit[10256]: AVC apparmor="DENIED" operation="file_lock" profile="firejail-default" name="/run/utmp" pid=10256 comm="x-terminal-emul" requested_mask="k" denied_mask="k" fsuid=1000 ouid=0 ``` So it seems that dbus is still working even though apparmor is supposed to be blocking it. My profile also blocks all network connections (`net none`) and my `dbus` is using regular Unix sockets. ~Even more mysteriously, using `apparmor` with `firefox` _seems to work_. That is, `firefox` dbus connections _are_ blocked.~ Never mind. Those are an unrelated error. I'm not getting any firefox dbus warnings in my journal. My `x-terminal-emulator` profile is [here](https://github.com/netblue30/firejail/files/2078382/x-terminal-emulator.txt).

gitea-mirror

2026-05-05 07:52:58 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 07:53:03 -06:00

Author

Owner

@smitsohu commented on GitHub (Jun 7, 2018):

This also puzzled me some time ago. It depends on your distribution, or more precisely on your kernel having the right patches.

Ubuntu patches their kernels, but Debian doesn't. Hope is that one day these patches will find their way into the mainline kernel. As far as I know the basic infrastructure is there since 4.17, so it shouldn't take too long now.

@smitsohu commented on GitHub (Jun 7, 2018): This also puzzled me some time ago. It depends on your distribution, or more precisely on your kernel having the right patches. Ubuntu patches their kernels, but Debian doesn't. Hope is that one day these patches will find their way into the mainline kernel. As far as I know the basic infrastructure is there since 4.17, so it shouldn't take too long now.

gitea-mirror commented

2026-05-05 07:53:05 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jun 7, 2018):

Huh. Since I build my own kernel, could you point me to the patches? I use Debian and use their sources, so that's probably why this issue cropped up for me.

@chiraag-nataraj commented on GitHub (Jun 7, 2018): Huh. Since I build my own kernel, could you point me to the patches? I use Debian and use their sources, so that's probably why this issue cropped up for me.

gitea-mirror commented

2026-05-05 07:53:07 -06:00

Author

Owner

@smitsohu commented on GitHub (Jun 7, 2018):

I guess this is what you're looking for: https://gitlab.com/apparmor/apparmor/tree/master/kernel-patches

But I didn't try myself, don't take my word for it

@smitsohu commented on GitHub (Jun 7, 2018): I guess this is what you're looking for: https://gitlab.com/apparmor/apparmor/tree/master/kernel-patches But I didn't try myself, don't take my word for it

gitea-mirror commented

2026-05-05 07:53:09 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jun 7, 2018):

lol they don't even have a patch for 4.16. Oh well. I guess I just have to wait for 4.17 to become stable (at least the version in the experimental repo is currently at 4.17-rc7).

@chiraag-nataraj commented on GitHub (Jun 7, 2018): lol they don't even _have_ a patch for 4.16. Oh well. I guess I just have to wait for 4.17 to become stable (at least the version in the experimental repo is currently at 4.17-rc7).

gitea-mirror commented

2026-05-05 07:53:11 -06:00

Author

Owner

@Vincent43 commented on GitHub (Jun 7, 2018):

@chiraag-nataraj mainline dbus support in apparmor is currently planned for linux 4.19. Some day they may release unofficial patches for earlier versions in aforementioned gitlab repo.

@Vincent43 commented on GitHub (Jun 7, 2018): @chiraag-nataraj mainline dbus support in apparmor is currently planned for linux 4.19. Some day they may release unofficial patches for earlier versions in aforementioned gitlab repo.

gitea-mirror commented

2026-05-05 07:53:13 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jun 7, 2018):

Hmmm, I see. Thanks :)

@chiraag-nataraj commented on GitHub (Jun 7, 2018): Hmmm, I see. Thanks :)

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1332

No description provided.

Rows
Columns