mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #2066] Tor Browser cannot execute with "noroot" and "nogroups" profile #1395
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1395
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Joonho365Han on GitHub (Jul 25, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2066
Originally assigned to: @chiraag-nataraj on GitHub.
Recreating the issue:
OR depending on the distro
/usr/bin/firejail --profile=/etc/firejail/tor-browser-en.profile /usr/bin/${YOUR_EXECUTABLE}
My torbrowser-launcher.local:
My exec command:
Considering this happened when I updated Firejail and not Tor Browser, I assume it has something to do with how Firejail changed implementation of "nogroups" and "noroot."
@chiraag-nataraj commented on GitHub (Jul 25, 2018):
I will investigate this and report back.
@chiraag-nataraj commented on GitHub (Jul 25, 2018):
Which version did you upgrade from? That way, I can do a
git bisectto find the offending commit.@Joonho365Han commented on GitHub (Jul 25, 2018):
It was upgraded from 0.9.52-1.
@chiraag-nataraj commented on GitHub (Jul 25, 2018):
Okay, thanks.
@SkewedZeppelin commented on GitHub (Jul 25, 2018):
@Joonho365Han are you using the proprietary NVIDIA driver?
@Joonho365Han commented on GitHub (Jul 25, 2018):
@SkewedZeppelin No I'm using Intel HD Graphics 520
@chiraag-nataraj commented on GitHub (Jul 25, 2018):
It's most likely apparmor. Do you have an apparmor profile for torbrowser?
@Joonho365Han commented on GitHub (Jul 25, 2018):
No. I do not use a custom local profile for Tor browser and the profile that came with firejail in this version does not enable apparmor.
@chiraag-nataraj commented on GitHub (Jul 25, 2018):
I'm not talking about the
apparmoroption infirejail, which turns on firejail's apparmor profile. I'm talking about a profile for the tor browser that might have been shipped with the tor browser. Even if you don't turn onapparmorinfirejail, if there's a matching profile that's been enabled (and some distros enable apparmor profiles by default), then that will still cause problems. One way you can see this is by looking in the system log (e.g.journalctl) to see if you get apparmor messages.@Joonho365Han commented on GitHub (Jul 26, 2018):
I believe only the TBB (Tor browser bundle) in Tails has AppArmor enabled by default. It also shouldn't be since Apparmor requires kernel modules and parameters to load and I do not have them enabled.
@chiraag-nataraj commented on GitHub (Jul 26, 2018):
Okay. Because on Debian, AppArmor was preventing Firejail from working correctly, and disabling the torbrowser-launcher (and associated) apparmor profiles allowed me to load torbrowser-launcher with
norootandnogroupsenabled. If you don't have apparmor enabled (and I really would double-check that it's not enabled), I'm not sure what's going on here.@Vincent43 commented on GitHub (Jul 26, 2018):
@Joonho365Han you didn't write what system you use. AppArmor is enabled by default in Ubuntu, Debian (testing, unstable), and openSUSE.
BTW: If you have AppArmor profile for your app it's possibly better to disable firejail rather than AppArmor.
@Joonho365Han commented on GitHub (Jul 26, 2018):
@Vincent43 Right. I realized it was necessary after chiraag just mentioned it. I'm using Arch and I don't have any MAC like Apparmor or SELinux installed that messes with blacklist/whitelist permissions.
@chiraag-nataraj commented on GitHub (Jul 26, 2018):
@Joonho365Han Huh, that's really weird then. Do you get anything showing up in your audit logs?
@Joonho365Han commented on GitHub (Jul 26, 2018):
@chiraag-nataraj No. Nothing even on system journal.
@Vincent43 commented on GitHub (Jul 26, 2018):
You can try installing latest firejail snapshot from AUR: https://aur.archlinux.org/packages/firejail-git/
@Joonho365Han commented on GitHub (Jul 27, 2018):
@Vincent43 That's actually not the official firejail package for Arch and it's not maintained since 2017. The official one I'm using is https://www.archlinux.org/packages/community/x86_64/firejail/ and it's up to date with the repo.
@chiraag-nataraj commented on GitHub (Jul 27, 2018):
@Joonho365Han Can you try building from the latest git version?
@Vincent43 commented on GitHub (Jul 27, 2018):
If you are new to Archlinux please read: https://wiki.archlinux.org/index.php/Arch_User_Repository
The package I linked will install the latest git version form github which is 157 commits ahead of what you currently use. For
*-gitpackages the "Last Updated" date doesn't matter as they automatically fetch new commits from git.@Joonho365Han commented on GitHub (Jul 27, 2018):
@Vincent43 Really? Good to know. I just tried it with the package you linked but it's still producing the same issue.
@chiraag-nataraj commented on GitHub (Jul 30, 2018):
So nothing shows up in your logs and yet this fails to start. Okay, I have an Arch VM. I'll try to see if I can figure something out.
@chiraag-nataraj commented on GitHub (Aug 6, 2018):
@Joonho365Han How did you install the tor browser bundle?
@Joonho365Han commented on GitHub (Aug 8, 2018):
Via the AUR.
@Fred-Barclay commented on GitHub (Aug 11, 2018):
@Joonho365Han Can you post the commands and terminal output of however you start the TBB inside firejail?
I'm on Arch, and using TBB from the tor website (not the AUR) and using
firejail --profile=/etc/firejail/start-tor-browser.profile ./start-tor-browser.desktopworks fine for me.Cheers!
@Joonho365Han commented on GitHub (Aug 12, 2018):
@Fred-Barclay I've updated the post with the requested info.
@chiraag-nataraj commented on GitHub (Aug 14, 2018):
@Joonho365Han The profile installed with firejail (from AUR) works fine in my archlinux VM with the tor-browser-en from AUR.
@chiraag-nataraj commented on GitHub (Aug 16, 2018):
@Joonho365Han Have you changed any defaults (with respect to "vanilla" Arch) that might be affecting this?
@Joonho365Han commented on GitHub (Aug 17, 2018):
@chiraag-nataraj What do you mean by defaults?
@chiraag-nataraj commented on GitHub (Aug 17, 2018):
@Joonho365Han I'm not really sure, since I only set up an Arch VM to test this (I don't use it on a daily basis). I guess what I mean is do you think anything else about your setup is relevant? Because based on the info you've given us, I was unable to reproduce the issue on my Arch VM.
@Joonho365Han commented on GitHub (Aug 17, 2018):
@chiraag-nataraj Not sure... Does firejail create a custom user to execute in the sandbox?
@chiraag-nataraj commented on GitHub (Aug 17, 2018):
@Joonho365Han Nope, at least not by default.
@ghost commented on GitHub (Feb 20, 2019):
Anyone solved this little problem? =)
I get 4 Warning: cleaning all supplementary groups when running firefox. The warnings disappear when I comment out 'noroot' from the firejail-common.profille. I have both stopped and disabled apparmor just to see so that it wasnt it creating these.
PS i have arch linux hardened kernel
@Joonho365Han commented on GitHub (Mar 2, 2019):
@anteg So I don't remember exactly when but I updated my entire system, which resolved the issue. I don't remember what version it started to work again. Try out the latest one?