github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #2387] RTNETLINK error using "--net" option #1591

New issue
Closed
opened 2026-05-05 08:14:51 -06:00 by gitea-mirror · 10 comments
gitea-mirror commented 2026-05-05 08:14:51 -06:00
Owner
Copy link

Originally created by @fvdb06 on GitHub (Feb 2, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2387

As soon I start firejail with the --net option I get unexpectedly exited with status 1

RTNETLINK answers: Operation not supported

muser@Cantara > firejail --net=tornet --noprofile
Parent pid 7935, child pid 7940
RTNETLINK answers: Operation not supported
Error: failed to run /usr/lib/firejail/fnet
Error ioctl: interface.c:98 net_if_up: No such device
Error: failed to run /run/firejail/lib/fnet
Error: proc 7935 cannot sync with peer: unexpected EOF
Peer 7940 unexpectedly exited with status 1

muser@Cantara > firejail --net=eth0 --noprofile
Parent pid 4489, child pid 4494
RTNETLINK answers: Operation not supported
Error: failed to run /usr/lib/firejail/fnet
Error ioctl: interface.c:98 net_if_up: No such device
Error: failed to run /run/firejail/lib/fnet
Error: proc 4489 cannot sync with peer: unexpected EOF
Peer 4494 unexpectedly exited with status 1

Originally created by @fvdb06 on GitHub (Feb 2, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2387 As soon I start firejail with the --net option I get unexpectedly exited with status 1 RTNETLINK answers: Operation not supported ------------------------------------------------- muser@Cantara > firejail --net=tornet --noprofile Parent pid 7935, child pid 7940 RTNETLINK answers: Operation not supported Error: failed to run /usr/lib/firejail/fnet Error ioctl: interface.c:98 net_if_up: No such device Error: failed to run /run/firejail/lib/fnet Error: proc 7935 cannot sync with peer: unexpected EOF Peer 7940 unexpectedly exited with status 1 ----------------------------------------------- muser@Cantara > firejail --net=eth0 --noprofile Parent pid 4489, child pid 4494 RTNETLINK answers: Operation not supported Error: failed to run /usr/lib/firejail/fnet Error ioctl: interface.c:98 net_if_up: No such device Error: failed to run /run/firejail/lib/fnet Error: proc 4489 cannot sync with peer: unexpected EOF Peer 4494 unexpectedly exited with status 1
gitea-mirror commented 2026-05-05 08:14:54 -06:00
Author
Owner
Copy link

@smitsohu commented on GitHub (Feb 2, 2019):

Looks like a duplicate of #2046.
Which Firejail version do you run?

<!-- gh-comment-id:459991272 --> @smitsohu commented on GitHub (Feb 2, 2019): Looks like a duplicate of #2046. Which Firejail version do you run?
gitea-mirror commented 2026-05-05 08:14:55 -06:00
Author
Owner
Copy link

@fvdb06 commented on GitHub (Feb 2, 2019):

#2046 states: my error was fixed at some point.
Unfortunately this is not my case.
muser@Cantara > pacman -Q firejail
firejail 0.9.58-1

<!-- gh-comment-id:459991515 --> @fvdb06 commented on GitHub (Feb 2, 2019): #2046 states: my error was fixed at some point. Unfortunately this is not my case. muser@Cantara > pacman -Q firejail firejail 0.9.58-1
gitea-mirror commented 2026-05-05 08:14:56 -06:00
Author
Owner
Copy link

@netblue30 commented on GitHub (Feb 2, 2019):

Run a /sbin/ifconfig and put the output here. How are your interfaces configured?

<!-- gh-comment-id:459995585 --> @netblue30 commented on GitHub (Feb 2, 2019): Run a /sbin/ifconfig and put the output here. How are your interfaces configured?
gitea-mirror commented 2026-05-05 08:14:57 -06:00
Author
Owner
Copy link

@fvdb06 commented on GitHub (Feb 2, 2019):

muser@Cantara > /sbin/ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.178.64  netmask 255.255.255.0  broadcast 192.168.178.255
        ether 74:d0:2b:7b:da:d6  txqueuelen 1000  (Ethernet)
        RX packets 12262  bytes 14616580 (13.9 MiB)
        RX errors 0  dropped 217  overruns 0  frame 0
        TX packets 7830  bytes 1508827 (1.4 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 20  memory 0xf7d00000-f7d20000  

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 3454  bytes 3909249 (3.7 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 3454  bytes 3909249 (3.7 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tornet: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.100.100.1  netmask 255.255.255.0  broadcast 10.100.100.255
        ether 42:ba:ba:aa:84:81  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 83  bytes 8968 (8.7 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

----------------------------------------------------------------
## /etc/systemd/network/25-wireless.network

[Match]
Name=wlan0

[Network]
## DHCP=yes to accept an IPv4 and IPv6 DHCP ##
#DHCP=ipv4
DHCP=yes
IPv6PrivacyExtensions=true
## to use static IP uncomment these instead of DHCP
#Address=192.168.1.87/24
#Gateway=192.168.1.255

## enable "LLMNR" for "systemd-resolved" so you can ping a "hostname"	##
## in local network directly without a formal dns server setup.		##
LLMNR=true

[DHCP]
RouteMetric=20

-------------------------------------------------------------
## /etc/systemd/network/50-wired.network

[Match]
#Name=eth0
Name=e*

[Network]
## DHCP=yes to accept an IPv4 and IPv6 DHCP ##
#DHCP=ipv4
DHCP=yes
IPv6PrivacyExtensions=true
## to use static IP uncomment these instead of DHCP
#Address=192.168.1.87/24
#Gateway=192.168.1.255

## enable "LLMNR" for "systemd-resolved" so you can ping a "hostname"	##
## in local network directly without a formal dns server setup.		##
LLMNR=true

[DHCP]
RouteMetric=10
<!-- gh-comment-id:459996098 --> @fvdb06 commented on GitHub (Feb 2, 2019): ``` muser@Cantara > /sbin/ifconfig eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.178.64 netmask 255.255.255.0 broadcast 192.168.178.255 ether 74:d0:2b:7b:da:d6 txqueuelen 1000 (Ethernet) RX packets 12262 bytes 14616580 (13.9 MiB) RX errors 0 dropped 217 overruns 0 frame 0 TX packets 7830 bytes 1508827 (1.4 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 device interrupt 20 memory 0xf7d00000-f7d20000 lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 loop txqueuelen 1000 (Local Loopback) RX packets 3454 bytes 3909249 (3.7 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 3454 bytes 3909249 (3.7 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 tornet: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 10.100.100.1 netmask 255.255.255.0 broadcast 10.100.100.255 ether 42:ba:ba:aa:84:81 txqueuelen 1000 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 83 bytes 8968 (8.7 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 ---------------------------------------------------------------- ## /etc/systemd/network/25-wireless.network [Match] Name=wlan0 [Network] ## DHCP=yes to accept an IPv4 and IPv6 DHCP ## #DHCP=ipv4 DHCP=yes IPv6PrivacyExtensions=true ## to use static IP uncomment these instead of DHCP #Address=192.168.1.87/24 #Gateway=192.168.1.255 ## enable "LLMNR" for "systemd-resolved" so you can ping a "hostname" ## ## in local network directly without a formal dns server setup. ## LLMNR=true [DHCP] RouteMetric=20 ------------------------------------------------------------- ## /etc/systemd/network/50-wired.network [Match] #Name=eth0 Name=e* [Network] ## DHCP=yes to accept an IPv4 and IPv6 DHCP ## #DHCP=ipv4 DHCP=yes IPv6PrivacyExtensions=true ## to use static IP uncomment these instead of DHCP #Address=192.168.1.87/24 #Gateway=192.168.1.255 ## enable "LLMNR" for "systemd-resolved" so you can ping a "hostname" ## ## in local network directly without a formal dns server setup. ## LLMNR=true [DHCP] RouteMetric=10 ```
gitea-mirror commented 2026-05-05 08:14:58 -06:00
Author
Owner
Copy link

@ghost commented on GitHub (Feb 5, 2019):

@fvdb06 This is a longshot, but have you already checked the restricted-network setting in your /etc/firejail/firejail.config? If you happen to see 'restricted-network yes' that would explain things, as in that case access to --interface, --net=foo and --netfilter is only granted to root user.

<!-- gh-comment-id:460522226 --> @ghost commented on GitHub (Feb 5, 2019): @fvdb06 This is a longshot, but have you already checked the `restricted-network` setting in your `/etc/firejail/firejail.config`? If you happen to see 'restricted-network yes' that would explain things, as in that case access to --interface, --net=foo and --netfilter is only granted to root user.
gitea-mirror commented 2026-05-05 08:14:59 -06:00
Author
Owner
Copy link

@netblue30 commented on GitHub (Feb 5, 2019):

Thanks @glitsj16, that could be the problem!

<!-- gh-comment-id:460714086 --> @netblue30 commented on GitHub (Feb 5, 2019): Thanks @glitsj16, that could be the problem!
gitea-mirror commented 2026-05-05 08:15:00 -06:00
Author
Owner
Copy link

@fvdb06 commented on GitHub (Feb 6, 2019):

For me this is not the problem: /etc/firejail/firejail.config

#Enable or disable restricted network support, default disabled. If enabled,
#networking features should also be enabled (network yes).
#Restricted networking grants access to --interface, --net=ethXXX and
#--netfilter only to root user. Regular users are only allowed --net=none.
restricted-network no

<!-- gh-comment-id:461193926 --> @fvdb06 commented on GitHub (Feb 6, 2019): For me this is not the problem: /etc/firejail/firejail.config #Enable or disable restricted network support, default disabled. If enabled, #networking features should also be enabled (network yes). #Restricted networking grants access to --interface, --net=ethXXX and #--netfilter only to root user. Regular users are only allowed --net=none. restricted-network no
gitea-mirror commented 2026-05-05 08:15:01 -06:00
Author
Owner
Copy link

@fvdb06 commented on GitHub (Feb 8, 2019):

I recently changed the start-up of my windowmanager. I start Fluxbox with systemd instead of .xinitrc
Has it a relationship with this????

<!-- gh-comment-id:461735097 --> @fvdb06 commented on GitHub (Feb 8, 2019): I recently changed the start-up of my windowmanager. I start Fluxbox with systemd instead of .xinitrc Has it a relationship with this????
gitea-mirror commented 2026-05-05 08:15:02 -06:00
Author
Owner
Copy link

@intika commented on GitHub (Apr 9, 2019):

Had a similar issue, this can be caused by a kernel update without reboot or a lack of needed kernel modules, to fix it either use a classic (main distribution) kernel or add the missing modules to your kernel

Also this Error ioctl: interface.c:98 net_if_up: No such device is typically raising because of missing module CONFIG_IPVLAN and or CONFIG_IPV6 technically --net parameter require only ipvlan but ipvlan have a "false" dependency on ipv6 there is kernel patch to fix that here or here if you still want to keep ipv6 disabled while getting firejail network feature working otherwise just add ipv6 along with ipvlan

Alternatively ifup lo command can give more details on error/missing module that could affect "firejail --net"

Here are the required kernel modules for firejail networking features: (this is an exhaustive list to get everything working you should be good with just ipvlan)

CONFIG_IPVLAN=m
CONFIG_IPVTAP=m
CONFIG_VXLAN=m
CONFIG_NET_VRF=m
CONFIG_NF_TABLES=m
CONFIG_NF_TABLES_NETDEV=m
CONFIG_NFT_RT=m
CONFIG_NFT_MASQ=m
CONFIG_NFT_REDIR=m
CONFIG_NFT_NAT=m
CONFIG_NFT_REJECT=m
CONFIG_NF_TABLES_IPV4=m
CONFIG_NFT_REJECT_IPV4=m
CONFIG_NFT_MASQ_IPV4=m
CONFIG_NFT_REDIR_IPV4=m
CONFIG_BRIDGE_EBT_VLAN=m
CONFIG_GARP=m
CONFIG_MRP=m
CONFIG_BRIDGE_VLAN_FILTERING=y
CONFIG_VLAN_8021Q=m
CONFIG_VLAN_8021Q_GVRP=y
CONFIG_VLAN_8021Q_MVRP=y
CONFIG_NET_L3_MASTER_DEV=y

Note that this also fix RTNETLINK answers: Operation not supported @netblue30 this info could may be added to the wiki or faq

<!-- gh-comment-id:481415470 --> @intika commented on GitHub (Apr 9, 2019): Had a similar issue, this can be caused by a kernel update without reboot or a lack of needed kernel modules, to fix it either use a classic (main distribution) kernel or add the missing modules to your kernel Also this `Error ioctl: interface.c:98 net_if_up: No such device` is typically raising because of missing module `CONFIG_IPVLAN` and or `CONFIG_IPV6` technically `--net` parameter require only `ipvlan` but `ipvlan` have a "false" dependency on `ipv6` there is kernel patch to fix that [here](https://patchwork.ozlabs.org/patch/873464/) or [here](https://patchwork.ozlabs.org/patch/874768/) if you still want to keep ipv6 disabled while getting firejail network feature working otherwise just add `ipv6` along with `ipvlan` Alternatively `ifup lo` command can give more details on error/missing module that could affect `"firejail --net"` Here are the required kernel modules for firejail networking features: (this is an exhaustive list to get everything working you should be good with just `ipvlan`) ``` CONFIG_IPVLAN=m CONFIG_IPVTAP=m CONFIG_VXLAN=m CONFIG_NET_VRF=m CONFIG_NF_TABLES=m CONFIG_NF_TABLES_NETDEV=m CONFIG_NFT_RT=m CONFIG_NFT_MASQ=m CONFIG_NFT_REDIR=m CONFIG_NFT_NAT=m CONFIG_NFT_REJECT=m CONFIG_NF_TABLES_IPV4=m CONFIG_NFT_REJECT_IPV4=m CONFIG_NFT_MASQ_IPV4=m CONFIG_NFT_REDIR_IPV4=m CONFIG_BRIDGE_EBT_VLAN=m CONFIG_GARP=m CONFIG_MRP=m CONFIG_BRIDGE_VLAN_FILTERING=y CONFIG_VLAN_8021Q=m CONFIG_VLAN_8021Q_GVRP=y CONFIG_VLAN_8021Q_MVRP=y CONFIG_NET_L3_MASTER_DEV=y ``` Note that this also fix `RTNETLINK answers: Operation not supported` @netblue30 this info could may be added to the wiki or faq
gitea-mirror commented 2026-05-05 08:15:02 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jan 25, 2020):

Duplicate of #2046

<!-- gh-comment-id:578403430 --> @rusty-snake commented on GitHub (Jan 25, 2020): Duplicate of #2046
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1591
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?