github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2083] --build broken #1410

New issue

Closed

opened 2026-05-05 08:04:25 -06:00 by gitea-mirror · 15 comments

gitea-mirror commented

2026-05-05 08:04:25 -06:00

Owner

Originally created by @reinerh on GitHub (Aug 15, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2083

I just noticed that the --build feature seems to be broken currently:

$ firejail --build cat ~/.bashrc
Error: the output file needs to be owned by the current user.
Error: cannot run the sandbox

Originally created by @reinerh on GitHub (Aug 15, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2083 I just noticed that the --build feature seems to be broken currently: ``` $ firejail --build cat ~/.bashrc Error: the output file needs to be owned by the current user. Error: cannot run the sandbox ```

gitea-mirror

2026-05-05 08:04:25 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 08:04:29 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Aug 15, 2018):

Unable to reproduce on Fedora or Arch built from 9c44e7a437

@SkewedZeppelin commented on GitHub (Aug 15, 2018): Unable to reproduce on Fedora or Arch built from 9c44e7a437475f1bd93039873cfbcaf61d5a4e92

gitea-mirror commented

2026-05-05 08:04:30 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 15, 2018):

Unable to reproduce on Debian sid+experimental built from df3f0b618e

@chiraag-nataraj commented on GitHub (Aug 15, 2018): Unable to reproduce on Debian sid+experimental built from df3f0b618e237cd2fcd74ea7a3ef398fbe290ca9

gitea-mirror commented

2026-05-05 08:04:31 -06:00

Author

Owner

@reinerh commented on GitHub (Aug 15, 2018):

oh, interesting... thanks. will investigate why it fails here.

@reinerh commented on GitHub (Aug 15, 2018): oh, interesting... thanks. will investigate why it fails here.

gitea-mirror commented

2026-05-05 08:04:33 -06:00

Author

Owner

@reinerh commented on GitHub (Aug 15, 2018):

Okay, it was an issue on my side...
I still had a file /tmp/firejail-trace owned by the root user.
And invoking --build with my normal user failed because it wanted to write trace output there as well.

But there still seems to be a different issue. By just creating a file /tmp/firejail-trace you can deny other users from using certain firejail functionality which requires writing to that file.
firejail doesn't even clean it up. So when you run firejail --build ls, and afterwards run the same command as another user, it will not be successful.
It's a small denial of service, if you can prevent other users from doing stuff.

Anyone else able to reproduce that?

@reinerh commented on GitHub (Aug 15, 2018): Okay, it was an issue on my side... I still had a file /tmp/firejail-trace owned by the root user. And invoking --build with my normal user failed because it wanted to write trace output there as well. But there still seems to be a different issue. By just creating a file /tmp/firejail-trace you can deny other users from using certain firejail functionality which requires writing to that file. firejail doesn't even clean it up. So when you run `firejail --build ls`, and afterwards run the same command as another user, it will not be successful. It's a small denial of service, if you can prevent other users from doing stuff. Anyone else able to reproduce that?

gitea-mirror commented

2026-05-05 08:04:34 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Aug 15, 2018):

By just creating a file /tmp/firejail-trace you can deny other users from using certain firejail functionality which requires writing to that file.

I can reproduce that.

@SkewedZeppelin commented on GitHub (Aug 15, 2018): > By just creating a file /tmp/firejail-trace you can deny other users from using certain firejail functionality which requires writing to that file. I can reproduce that.

gitea-mirror commented

2026-05-05 08:04:34 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 15, 2018):

Hmm. I created /tmp/firejail-trace (sudo touch /tmp/firejail-trace) and yet I was still able to use firejail --build successfully...
[edit] never mind, I can reproduce.

@chiraag-nataraj commented on GitHub (Aug 15, 2018): Hmm. I created `/tmp/firejail-trace` (`sudo touch /tmp/firejail-trace`) and yet I was still able to use `firejail --build` successfully... [edit] never mind, I can reproduce.

gitea-mirror commented

2026-05-05 08:04:35 -06:00

Author

Owner

@reinerh commented on GitHub (Aug 15, 2018):

So root is the owner of your file and you are running firejail as normal user?
When you add --debug, do you see --output=/tmp/firejail-trace?

@reinerh commented on GitHub (Aug 15, 2018): So root is the owner of your file and you are running firejail as normal user? When you add `--debug`, do you see `--output=/tmp/firejail-trace`?

gitea-mirror commented

2026-05-05 08:04:36 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 15, 2018):

@reinerh When I ran it the first time, I suspect touch didn't actually do anything (since the files already existed). When I cleaned up from previous runs and repeated the steps, I could reproduce the issue.

@chiraag-nataraj commented on GitHub (Aug 15, 2018): @reinerh When I ran it the first time, I suspect `touch` didn't actually do anything (since the files already existed). When I cleaned up from previous runs and repeated the steps, I could reproduce the issue.

gitea-mirror commented

2026-05-05 08:04:36 -06:00

Author

Owner

@Vincent43 commented on GitHub (Aug 16, 2018):

Perhaps instead of touch /tmp/firejail-trace it should use mktemp /tmp/firejail-trace-XXXXXX.

@Vincent43 commented on GitHub (Aug 16, 2018): Perhaps instead of `touch /tmp/firejail-trace` it should use `mktemp /tmp/firejail-trace-XXXXXX`.

gitea-mirror commented

2026-05-05 08:04:37 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 16, 2018):

Working on it.

@chiraag-nataraj commented on GitHub (Aug 16, 2018): Working on it.

gitea-mirror commented

2026-05-05 08:04:38 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 16, 2018):

Also @Vincent43, the touch stuff was just me testing to see if I could reproduce. In the C code, there was a hard-coded filename, which is what I ended up changing (so same idea, just the C version).

@chiraag-nataraj commented on GitHub (Aug 16, 2018): Also @Vincent43, the `touch` stuff was just me testing to see if I could reproduce. In the C code, there was a hard-coded filename, which is what I ended up changing (so same idea, just the C version).

gitea-mirror commented

2026-05-05 08:04:39 -06:00

Author

Owner

@reinerh commented on GitHub (Aug 16, 2018):

@chiraag-nataraj Are you also cleaning up the files again when they are no longer needed? I couldn't find an unlink in your commit.
Because that was also a reason why this bug occured.

@reinerh commented on GitHub (Aug 16, 2018): @chiraag-nataraj Are you also cleaning up the files again when they are no longer needed? I couldn't find an `unlink` in your commit. Because that was also a reason why this bug occured.

gitea-mirror commented

2026-05-05 08:04:40 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 16, 2018):

@reinerh I'm currently not doing that, but since a unique file is created each time it's run, the bug should be fixed. I can also modify it to clean up after itself, but I wasn't sure if we wanted to keep the files around so that they could be inspected later?

@chiraag-nataraj commented on GitHub (Aug 16, 2018): @reinerh I'm currently not doing that, but since a unique file is created each time it's run, the bug should be fixed. I can also modify it to clean up after itself, but I wasn't sure if we wanted to keep the files around so that they could be inspected later?

gitea-mirror commented

2026-05-05 08:04:41 -06:00

Author

Owner

@reinerh commented on GitHub (Aug 16, 2018):

I think cleaning up would be better, as they are no longer needed after the profile is built, and it would only fill /tmp with trash.

@reinerh commented on GitHub (Aug 16, 2018): I think cleaning up would be better, as they are no longer needed after the profile is built, and it would only fill /tmp with trash.

gitea-mirror commented

2026-05-05 08:04:41 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 16, 2018):

👍 I'll put that in.

@chiraag-nataraj commented on GitHub (Aug 16, 2018): :+1: I'll put that in.

gitea-mirror referenced this issue

2026-05-05 10:10:56 -06:00

[PR #1410] [MERGED] Improve seccomp printing #3949

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1410

No description provided.

Rows
Columns