github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #25] loop devices #17

New issue

Closed

opened 2026-05-05 04:45:02 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 04:45:02 -06:00

Owner

Originally created by @suedi on GitHub (Aug 14, 2015).
Original GitHub issue: https://github.com/netblue30/firejail/issues/25

I guess this is the active place for firejail now so I re-post here the same trouble
that I did on sourceforge.

I am on 0.9.28-rc1

I met with a problem I do not understand using firejail.

When I have an application started in firejail and do as root,
outside of jail, losetup -d /dev/loopXX ( or umount -d )

the command returns OK but loop device is just marked auto-clear
that is will remain until all references to it are closed.

If I have no application started with firejail the command just releases
the loop device so that makes me draw the conclusion that firejail
instance hold a reference to it.

Anyway I tried both private-dev and mounting a tmpfs on the directoty holding the
mount point but still firejail holds a reference to the loop device.

I tried lsof that reported no open references then I tried
fuser -v -m mntpnt and my whole system went down.

Please explain how it comes to have this reference!

How can I tell firejail not to hold a reference to the loop device????

Originally created by @suedi on GitHub (Aug 14, 2015). Original GitHub issue: https://github.com/netblue30/firejail/issues/25 I guess this is the active place for firejail now so I re-post here the same trouble that I did on sourceforge. I am on 0.9.28-rc1 I met with a problem I do not understand using firejail. When I have an application started in firejail and do as root, outside of jail, losetup -d /dev/loopXX ( or umount -d ) the command returns OK but loop device is just marked auto-clear that is will remain until all references to it are closed. If I have no application started with firejail the command just releases the loop device so that makes me draw the conclusion that firejail instance hold a reference to it. Anyway I tried both private-dev and mounting a tmpfs on the directoty holding the mount point but still firejail holds a reference to the loop device. I tried lsof that reported no open references then I tried fuser -v -m mntpnt and my whole system went down. Please explain how it comes to have this reference! How can I tell firejail not to hold a reference to the loop device????

gitea-mirror closed this issue

2026-05-05 04:45:04 -06:00

gitea-mirror commented

2026-05-05 04:45:08 -06:00

Author

Owner

@ghost commented on GitHub (Aug 14, 2015):

You mentioned a mount point, which suggests you're mounting your loop device somewhere. Can you tell us what you're doing with the loop device? We need to be able to reproduce this on our own machines so please let us know what steps you do to set up and use your loop device.

@ghost commented on GitHub (Aug 14, 2015): You mentioned a mount point, which suggests you're mounting your loop device somewhere. Can you tell us what you're doing with the loop device? We need to be able to reproduce this on our own machines so please let us know what steps you do to set up and use your loop device.

gitea-mirror commented

2026-05-05 04:45:12 -06:00

Author

Owner

@suedi commented on GitHub (Aug 18, 2015):

I am on a puppy linux like system using AUFS.

The loop devices are squash archives of different Arch linux packages I use on that system.

At boot time these packages are loop mounted and then added to AUFS union.
AUFS root is /

This can also be done dynamically with a booted up system.

Example: BUNDLE="htop.sb"

Mounting

  mkdir /mnt/live/memory/bundles/"$BUNDLE"
  mount -o loop "$BUNDLE" /mnt/live/memory/bundles/"$BUNDLE"
  mount -n -o remount,add:$POSITION:/mnt/live/memory/bundles/"$BUNDLE"=rr aufs /

unmounting

  mount -n -o remount,del:/mnt/live/memory/bundles/"$BUNDLE" aufs / 2>/dev/null
  umount -d /mnt/live/memory/bundles/"$BUNDLE" 2>/dev/null
  rmdir /mnt/live/memory/bundles/"$BUNDLE" 2>/dev/null

Note removing BUNDLE from aufs is OK. Unmounting Bundle is OK
That is the files in that BUNDLE disappears from system.
Freeing the loop device does not work that is it gets marked for auto-clear
and disappears first when all firejail are exited.

If I check mount point /mnt/live/memory/bundles/"$BUNDLE" it is empty but the
dir cannot be removed

loset | grep htop.sb yields

NAME	SIZELIMIT	OFFSET	AUTOCLEAR	RO	BACK-FILE
/dev/loop28	0	0	1	0	/mnt/live/memory/toram/modules/htop.sb

I am starting firejail as an unprivilegied user

please let me know If you need more information

@suedi commented on GitHub (Aug 18, 2015): I am on a puppy linux like system using AUFS. The loop devices are squash archives of different Arch linux packages I use on that system. At boot time these packages are loop mounted and then added to AUFS union. AUFS root is / This can also be done dynamically with a booted up system. Example: BUNDLE="htop.sb" Mounting ``` bash mkdir /mnt/live/memory/bundles/"$BUNDLE" mount -o loop "$BUNDLE" /mnt/live/memory/bundles/"$BUNDLE" mount -n -o remount,add:$POSITION:/mnt/live/memory/bundles/"$BUNDLE"=rr aufs / ``` unmounting ``` bash mount -n -o remount,del:/mnt/live/memory/bundles/"$BUNDLE" aufs / 2>/dev/null umount -d /mnt/live/memory/bundles/"$BUNDLE" 2>/dev/null rmdir /mnt/live/memory/bundles/"$BUNDLE" 2>/dev/null ``` Note removing BUNDLE from aufs is OK. Unmounting Bundle is OK That is the files in that BUNDLE disappears from system. Freeing the loop device does not work that is it gets marked for auto-clear and disappears first when all firejail are exited. If I check mount point /mnt/live/memory/bundles/"$BUNDLE" it is empty but the dir cannot be removed loset | grep htop.sb yields | NAME | SIZELIMIT | OFFSET | AUTOCLEAR | RO | BACK-FILE | | --- | --- | --- | --- | --- | --- | | /dev/loop28 | 0 | 0 | 1 | 0 | /mnt/live/memory/toram/modules/htop.sb | I am starting firejail as an unprivilegied user please let me know If you need more information

gitea-mirror commented

2026-05-05 04:45:15 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 26, 2015):

How can I tell firejail not to hold a reference to the loop device?

There is no way you could do that. When firejail starts it creates a new mount namespace and inherits all existing mounts on your system. So, your loop device mount gets a new reference. The reference will be removed once you exit firejail .

@netblue30 commented on GitHub (Aug 26, 2015): > How can I tell firejail not to hold a reference to the loop device? There is no way you could do that. When firejail starts it creates a new mount namespace and inherits all existing mounts on your system. So, your loop device mount gets a new reference. The reference will be removed once you exit firejail .

gitea-mirror commented

2026-05-05 04:45:17 -06:00

Author

Owner

@suedi commented on GitHub (Aug 26, 2015):

I don't get this

cause the umount works fine. Not a trace in /proc/mounts or in filesystem

Only thing left is the mount point and a entry in losetup

if the unmount works fine why shouldn't the losetup -f also work

Okay I guess I have to accept this and re-write some of my system tools
to take this into account.

So I guess I am closing this issue

Thanks for help, keep up the good work.

@suedi commented on GitHub (Aug 26, 2015): I don't get this cause the umount works fine. Not a trace in /proc/mounts or in filesystem Only thing left is the mount point and a entry in losetup if the unmount works fine why shouldn't the losetup -f also work Okay I guess I have to accept this and re-write some of my system tools to take this into account. So I guess I am closing this issue Thanks for help, keep up the good work.

gitea-mirror referenced this issue

2026-05-05 10:02:42 -06:00

[PR #17] [MERGED] A bit more for CVE-2015-4495 #3506

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#17

No description provided.

Rows
Columns