github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2849] Build AppImage bundle of firejail #1782

New issue

Open

opened 2026-05-05 08:26:57 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 08:26:57 -06:00

Owner

Originally created by @crass on GitHub (Jul 9, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2849

This was suggested in #2397, however it was closed without really addressing this. It would be nice to have a single firejail.appimage binary created with all profiles bundled (but that checks for user defined profiles). I'm not sure how AppImage works with bundled setuid binaries, so this request might not be feasible or otherwise problematic. We should target very old CPUs and bundle every possible library to support as many systems as possible (within reason, there's an appimage size to num supported trade off).

Originally created by @crass on GitHub (Jul 9, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2849 This was suggested in #2397, however it was closed without really addressing this. It would be nice to have a single firejail.appimage binary created with all profiles bundled (but that checks for user defined profiles). I'm not sure how AppImage works with bundled setuid binaries, so this request might not be feasible or otherwise problematic. We should target very old CPUs and bundle every possible library to support as many systems as possible (within reason, there's an appimage size to num supported trade off).

gitea-mirror added the

enhancement

label 2026-05-05 08:26:57 -06:00

gitea-mirror commented

2026-05-05 08:26:59 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Jul 9, 2019):

I'll take a shot at this

@Fred-Barclay commented on GitHub (Jul 9, 2019): I'll take a shot at this

gitea-mirror commented

2026-05-05 08:27:00 -06:00

Author

Owner

@crass commented on GitHub (Jul 10, 2019):

Reading the fuse kernel doc in section "How are requirements fulfilled?" part A, it says that unprivileged fuse mounts automatically get nosuid. Of course this makes sense, regular users should not be able to create code that runs setuid. So what this means is that we'll need to have the appimage, once downloaded, set by the user with the setuid bit and ownded by root. I suspect that if we have AppRun be a shell script that uses bash (standard practice), then bash will kill our setuid privs. This can probably be worked around by using /bin/sh, a less functional shell, but I don't think we need much functionality anyway.

We may want to consider doing seteuid($USER) in the AppRun to have as little code executed as root as possible (this might be over kill if its a trivial script). Reading man capabilities and man credentials, I think exec'ing firejail from AppRun should work as though firejail was executed with setuid. But I'm not sure, and this may be a source of problems. Make sure to check this using firejail's --debug option, which will print log messages detailing uid and euid.

@Fred-Barclay I'd love to hear what your experiences are in getting this to work. And can help if you run in to snags.

@crass commented on GitHub (Jul 10, 2019): Reading the [fuse kernel doc](https://www.kernel.org/doc/Documentation/filesystems/fuse.txt) in section "How are requirements fulfilled?" part A, it says that unprivileged fuse mounts automatically get `nosuid`. Of course this makes sense, regular users should not be able to create code that runs setuid. So what this means is that we'll need to have the appimage, once downloaded, set by the user with the setuid bit and ownded by root. I suspect that if we have AppRun be a shell script that uses bash (standard practice), then [bash will kill our setuid privs](https://stackoverflow.com/questions/556194/calling-a-script-from-a-setuid-root-c-program-script-does-not-run-as-root). This can probably be worked around by using `/bin/sh`, a less functional shell, but I don't think we need much functionality anyway. We may want to consider doing `seteuid($USER)` in the AppRun to have as little code executed as root as possible (this might be over kill if its a trivial script). Reading `man capabilities` and `man credentials`, I think exec'ing firejail from AppRun should work as though firejail was executed with setuid. But I'm not sure, and this may be a source of problems. Make sure to check this using firejail's `--debug` option, which will print log messages detailing `uid` and `euid`. @Fred-Barclay I'd love to hear what your experiences are in getting this to work. And can help if you run in to snags.

gitea-mirror commented

2026-05-05 08:27:01 -06:00

Author

Owner

@reinerh commented on GitHub (Jul 10, 2019):

This can probably be worked around by using /bin/sh.

It's possible that /bin/sh is a symlink to bash (or any other shell), so you can't generally assume that sh is a "less functional shell".

@reinerh commented on GitHub (Jul 10, 2019): > This can probably be worked around by using /bin/sh. It's possible that /bin/sh is a symlink to bash (or any other shell), so you can't generally assume that sh is a "less functional shell".

gitea-mirror commented

2026-05-05 08:27:02 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Jul 28, 2019):

Small update -- this is taking longer than I thought, mostly because I'm having to work weekends now! ☹️ In the middle of a big project...

I'm still going to work on this but if someone else wants to try this and gets it working before me -- go ahead! 😄

@Fred-Barclay commented on GitHub (Jul 28, 2019): Small update -- this is taking longer than I thought, mostly because I'm having to work weekends now! :frowning_face: In the middle of a big project... I'm still going to work on this but if someone else wants to try this and gets it working before me -- go ahead! :smile:

gitea-mirror commented

2026-05-05 08:27:03 -06:00

Author

Owner

@karam72 commented on GitHub (Mar 13, 2022):

If a developers need help for "testing" I'm here to help for this.

@karam72 commented on GitHub (Mar 13, 2022): If a developers need help for "testing" I'm here to help for this.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1782

No description provided.

Rows
Columns