github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2364] apparmor bash shell gives weird message #1574

New issue

Closed

opened 2026-05-05 08:13:58 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 08:13:58 -06:00

Owner

Originally created by @bclark76 on GitHub (Jan 23, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2364

This is a firejail question, but let me provide some context:

I have an anon user that has all of its network traffic firewalled with iptables to only go through tor's trans-port. This includes loopback traffic which is dropped for that user except that destined for port 53 which is natted to 127.0.0.1:5353 where tor is listening.

Here's my iptables rules heavily inspired by some I found on the torproject site. They say that despite
these there are cases where dns traffic leaks 'somehow'. This seems to work but I wondered what somehow there could be.. Continued below after this file:

#!/bin/bash

iptables --flush
iptables --table nat --flush

iptables --delete-chain

iptables --policy INPUT DROP
iptables --policy FORWARD DROP
iptables --policy OUTPUT ACCEPT

iptables --append INPUT --in-interface lo --jump ACCEPT

ANON_UID=anon
TOR_TRANS_PORT=9040
TOR_DNS_PORT=5353
DNS_PORT=53
iptables --table nat
--append OUTPUT
! --out-interface lo
--protocol tcp
--match owner --uid-owner $ANON_UID
--match tcp
--jump REDIRECT --to-ports $TOR_TRANS_PORT

iptables --table nat
--append OUTPUT
! --out-interface lo
--protocol udp
--match owner --uid-owner $ANON_UID
--match udp --dport $DNS_PORT
--jump REDIRECT --to-ports $TOR_DNS_PORT
iptables --table filter
--append OUTPUT
--protocol tcp
--match owner --uid-owner $ANON_UID
--match tcp --dport $TOR_TRANS_PORT
--jump ACCEPT

iptables --table filter
--append OUTPUT
--protocol udp
--match owner --uid-owner $ANON_UID
--match udp --dport $TOR_DNS_PORT
--jump ACCEPT

iptables --table filter
--append OUTPUT
! --out-interface lo
--match owner --uid-owner $ANON_UID
--jump DROP

Allow established sessions to receive traffic

iptables --append INPUT --match conntrack --ctstate ESTABLISHED,RELATED --jump ACCEPT

Continued here.

I started thunar in a terminal session owned by anon. I noticed that thumbnails didn't work. Looking further I see that thunar file manager uses tumblerd thumbnailing service to create thumbnails. I see that tumblerd is a 'DBus' service that supposedly uses unix sockets, but can listen on a port? Not sure. I also noticed that pulseaudio sound server is a 'DBus' service though the config appears to only let the pulse user connect ( I have pulseaudio configured to run as a systemwide service so that multiple users can play sounds. ) However sound-test works while logged in as anon whereas the thumbnailer does not.

I tried to configure /etc/dbus/system-local.conf to disable only the anon user's access to dbus, but whatever I do there it makes my machine not boot.

So I wondered if firejail might be able to help. It can, but it has to be used with apparmor for this it seems.

When I do firejail thunar I can still see thumbnails, and when I do firejail speaker-test I get sound.

(however speaker-test works even under the anon user)

But when I do firejail --apparmor thunar I see no thumbnails and when I do firejail --apparmor speaker-test I hear no sound.

So I figure great I'll make /usr/bin/firejail --apparmor anon's shell. But that didn't work. I created a script that just does exec /usr/bin/firejail --apparmor "$@" but that didn't work - something about too many parameters. So I make /usr/bin/firejail anon's shell and put apparmor into /etc/firejail/globals.local

Now anon cannot play sound and firejail thunar breaks thumbnailing from every user. This is what I wanted.

The question is: when I do sudo su - anon I get this warning:

$ sudo su - anon
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/globals.local
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc

** Note: you can use --noprofile to disable default.profile **

Parent pid 2611, child pid 2612
Child process initialized in 43.20 ms
Warning: an existing sandbox was detected. /bin/bash will run without any additional sandboxing features

Sound and thumbnails are still broken so I assume I am protected, but why do I get this message?

$ sudo firemon
[sudo] password for aku:
2611:anon:-su
2612:anon:-su
2615:anon:/bin/bash

Originally created by @bclark76 on GitHub (Jan 23, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2364 This is a firejail question, but let me provide some context: I have an anon user that has all of its network traffic firewalled with iptables to only go through tor's trans-port. This includes loopback traffic which is dropped for that user except that destined for port 53 which is natted to 127.0.0.1:5353 where tor is listening. Here's my iptables rules heavily inspired by some I found on the torproject site. They say that despite these there are cases where dns traffic leaks 'somehow'. This seems to work but I wondered what somehow there could be.. Continued below after this file: #!/bin/bash iptables --flush iptables --table nat --flush iptables --delete-chain iptables --policy INPUT DROP iptables --policy FORWARD DROP iptables --policy OUTPUT ACCEPT iptables --append INPUT --in-interface lo --jump ACCEPT ANON_UID=anon TOR_TRANS_PORT=9040 TOR_DNS_PORT=5353 DNS_PORT=53 iptables --table nat \ --append OUTPUT \ ! --out-interface lo \ --protocol tcp \ --match owner --uid-owner $ANON_UID \ --match tcp \ --jump REDIRECT --to-ports $TOR_TRANS_PORT iptables --table nat \ --append OUTPUT \ ! --out-interface lo \ --protocol udp \ --match owner --uid-owner $ANON_UID \ --match udp --dport $DNS_PORT \ --jump REDIRECT --to-ports $TOR_DNS_PORT iptables --table filter \ --append OUTPUT \ --protocol tcp \ --match owner --uid-owner $ANON_UID \ --match tcp --dport $TOR_TRANS_PORT \ --jump ACCEPT iptables --table filter \ --append OUTPUT \ --protocol udp \ --match owner --uid-owner $ANON_UID \ --match udp --dport $TOR_DNS_PORT \ --jump ACCEPT iptables --table filter \ --append OUTPUT \ ! --out-interface lo \ --match owner --uid-owner $ANON_UID \ --jump DROP # Allow established sessions to receive traffic iptables --append INPUT --match conntrack --ctstate ESTABLISHED,RELATED --jump ACCEPT Continued here. I started thunar in a terminal session owned by anon. I noticed that thumbnails didn't work. Looking further I see that thunar file manager uses tumblerd thumbnailing service to create thumbnails. I see that tumblerd is a 'DBus' service that supposedly uses unix sockets, but can listen on a port? Not sure. I also noticed that pulseaudio sound server is a 'DBus' service though the config appears to only let the pulse user connect ( I have pulseaudio configured to run as a systemwide service so that multiple users can play sounds. ) However sound-test works while logged in as anon whereas the thumbnailer does not. I tried to configure /etc/dbus/system-local.conf to disable only the anon user's access to dbus, but whatever I do there it makes my machine not boot. So I wondered if firejail might be able to help. It can, but it has to be used with apparmor for this it seems. When I do firejail thunar I can still see thumbnails, and when I do firejail speaker-test I get sound. (however speaker-test works even under the anon user) But when I do firejail --apparmor thunar I see no thumbnails and when I do firejail --apparmor speaker-test I hear no sound. So I figure great I'll make /usr/bin/firejail --apparmor anon's shell. But that didn't work. I created a script that just does exec /usr/bin/firejail --apparmor "$@" but that didn't work - something about too many parameters. So I make /usr/bin/firejail anon's shell and put apparmor into /etc/firejail/globals.local Now anon cannot play sound and firejail thunar breaks thumbnailing from every user. This is what I wanted. The question is: when I do sudo su - anon I get this warning: $ sudo su - anon Reading profile /etc/firejail/default.profile Reading profile /etc/firejail/globals.local Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc ** Note: you can use --noprofile to disable default.profile ** Parent pid 2611, child pid 2612 Child process initialized in 43.20 ms Warning: an existing sandbox was detected. /bin/bash will run without any additional sandboxing features Sound and thumbnails are still broken so I assume I am protected, but why do I get this message? $ sudo firemon [sudo] password for aku: 2611:anon:-su 2612:anon:-su 2615:anon:/bin/bash

gitea-mirror closed this issue

2026-05-05 08:13:59 -06:00

gitea-mirror commented

2026-05-05 08:14:01 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 21, 2019):

Do you get the same issue if you try using sudo -u anon -i instead?

@chiraag-nataraj commented on GitHub (May 21, 2019): Do you get the same issue if you try using `sudo -u anon -i` instead?

gitea-mirror commented

2026-05-05 08:14:02 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 29, 2019):

@bclark76 I'm closing here due to inactivity, please fell free to reopen if you still have this question.

@rusty-snake commented on GitHub (Jun 29, 2019): @bclark76 I'm closing here due to inactivity, please fell free to reopen if you still have this question.

gitea-mirror referenced this issue

2026-05-05 08:18:41 -06:00

[GH-ISSUE #2624] firecfg does not detect all .desktop files for cleaning #1665

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1574

No description provided.

Rows
Columns