github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2342] Regression: Relative profile include silently ignored #1562

New issue

Closed

opened 2026-05-05 08:13:25 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 08:13:25 -06:00

Owner

Originally created by @thomasjfox on GitHub (Jan 14, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2342

Hello,

I've upgraded an ancient firejail 0.9.47 installation to firejail 0.9.56 LTS.

At first I didn't notice my custom netfilter rules were silently no longer applied. It all surfaced when I wanted to show the cool network sandboxing to a coworker and I tried to access the Internet from an "Intranet only" browser... and it worked despite the supposedly active firewall rules :o)

I've poked around profile.c and the issue is probably due to this:

commit 07a01b1f45
AuthorDate: Tue Oct 9 05:43:06 2018 -0500

Allow include to search userdir then systemdir for "bare" profile file names.

My firejail invocation and config file layout was like this:

cd $(HOME)/.firejail
firejail --profile=$HOME/.firejail/firefox-intranet.profile

The "firefox-intranet.profile" contains an "include firefox-custom-common.profile" statement which then has statements like "net virbr0".

The problem is that the profile-to-include filename is relative to the current dir and the new code detects it is not an absolute path. Therefore it calls profile_find_firejail() which just searches $(HOME)/.config/firejail and /etc/firejail.

So I moved the profiles to $HOME/.config/firejail and everything started working again. Another workaround was to prefix the filenames with './'

While it's might be a worthwhile security feature not to load a profile from the current working directory, it would be nice to include a profile relative to the path of the profile that contains the "include xyz" statement.

Also, and this is the more important part, it would have been nice if there was any kind of warning if a specified profile can't be found. Even --debug didn't show it.

Proposal:

Issue a warning or error if "include xyz" does not find a profile and the profile name doesn't end in ".local".
Abort with an error if a "netfilter xyz" configuration is given but we are in host network mode. As my second profile wasn't included, firejail didn't see the "net virbr0" statement anymore and defaulted to host networking. I'd rather have it abort in this case than to risk full network access.

Opinions?

Originally created by @thomasjfox on GitHub (Jan 14, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2342 Hello, I've upgraded an ancient firejail 0.9.47 installation to firejail 0.9.56 LTS. At first I didn't notice my custom netfilter rules were *silently* no longer applied. It all surfaced when I wanted to show the cool network sandboxing to a coworker and I tried to access the Internet from an "Intranet only" browser... and it worked despite the supposedly active firewall rules :o) I've poked around profile.c and the issue is probably due to this: commit 07a01b1f4503ad5681771e2b4c5307db597f81f8 AuthorDate: Tue Oct 9 05:43:06 2018 -0500 Allow include to search userdir then systemdir for "bare" profile file names. My firejail invocation and config file layout was like this: cd $(HOME)/.firejail firejail --profile=$HOME/.firejail/firefox-intranet.profile The "firefox-intranet.profile" contains an "include firefox-custom-common.profile" statement which then has statements like "net virbr0". The problem is that the profile-to-include filename is relative to the current dir and the new code detects it is not an absolute path. Therefore it calls profile_find_firejail() which just searches $(HOME)/.config/firejail and /etc/firejail. So I moved the profiles to $HOME/.config/firejail and everything started working again. Another workaround was to prefix the filenames with './' While it's might be a worthwhile security feature not to load a profile from the current working directory, it would be nice to include a profile relative to the path of the profile that contains the "include xyz" statement. Also, and this is the more important part, it would have been nice if there was any kind of warning if a specified profile can't be found. Even --debug didn't show it. Proposal: 1. Issue a warning or error if "include xyz" does not find a profile *and* the profile name doesn't end in ".local". 2. Abort with an error if a "netfilter xyz" configuration is given but we are in host network mode. As my second profile wasn't included, firejail didn't see the "net virbr0" statement anymore and defaulted to host networking. I'd rather have it abort in this case than to risk full network access. Opinions?

gitea-mirror

2026-05-05 08:13:25 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 08:13:28 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 20, 2019):

Sure, let me look into it. There are also some changes coming into the 0.9.58 for handling the include paths.

@netblue30 commented on GitHub (Jan 20, 2019): Sure, let me look into it. There are also some changes coming into the 0.9.58 for handling the include paths.

gitea-mirror commented

2026-05-05 08:13:29 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 10, 2019):

$ echo "include b.profile" > a.profile
$ echo "seccomp" > b.profile
$ firejail --profile=a.profile bash
Reading profile a.profile
Reading profile b.profile

@rusty-snake commented on GitHub (Nov 10, 2019): ``` $ echo "include b.profile" > a.profile $ echo "seccomp" > b.profile $ firejail --profile=a.profile bash Reading profile a.profile Reading profile b.profile ```

gitea-mirror commented

2026-05-05 08:13:30 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 25, 2020):

still an issue?

@rusty-snake commented on GitHub (Jan 25, 2020): still an issue?

gitea-mirror commented

2026-05-05 08:13:31 -06:00

Author

Owner

@rusty-snake commented on GitHub (May 12, 2021):

I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.

@rusty-snake commented on GitHub (May 12, 2021): I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1562

No description provided.

Rows
Columns