github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2893] Adding 'apparmor' to dolphin.profile to mitigate KDE vulnerability? #1809

New issue

Closed

opened 2026-05-05 08:28:52 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 08:28:52 -06:00

Owner

Originally created by @curiosity-seeker on GitHub (Aug 7, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2893

There have been reports about a vulnerability in KDE Frameworks, the details can be found here.

Would adding apparmor to the dolphin.profile mitigate this vulnerability as /etc/apparmor.d/firejail-default would "Allow running programs only from well-known system directories" ? Are there other possibilities to mitigate this threat?

After adding apparmor to the profile sudo aa-status reports:

17 processes are in enforce mode.
   ...
   /usr/bin/dolphin (24109) firejail-default
   /usr/lib/kf5/kioslave (24117) firejail-default
   /usr/lib/kf5/kioslave (24119) firejail-default
   /usr/lib/kf5/kioslave (24121) firejail-default
   /usr/lib/kf5/kioslave (24124) firejail-default
   /usr/lib/kf5/kioslave (24126) firejail-default
   /usr/lib/kf5/kioslave (24131) firejail-default
   ...

So far I haven't run into problems.

Originally created by @curiosity-seeker on GitHub (Aug 7, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2893 There have been [reports](https://www.zdnet.com/article/unpatched-kde-vulnerability-disclosed-on-twitter/) about a vulnerability in KDE Frameworks, the details can be found [here](https://gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txt). Would adding `apparmor` to the dolphin.profile mitigate this vulnerability as `/etc/apparmor.d/firejail-default` would "Allow running programs only from well-known system directories" ? Are there other possibilities to mitigate this threat? After adding `apparmor` to the profile `sudo aa-status` reports: ``` 17 processes are in enforce mode. ... /usr/bin/dolphin (24109) firejail-default /usr/lib/kf5/kioslave (24117) firejail-default /usr/lib/kf5/kioslave (24119) firejail-default /usr/lib/kf5/kioslave (24121) firejail-default /usr/lib/kf5/kioslave (24124) firejail-default /usr/lib/kf5/kioslave (24126) firejail-default /usr/lib/kf5/kioslave (24131) firejail-default ... ``` So far I haven't run into problems.

gitea-mirror closed this issue

2026-05-05 08:28:53 -06:00

gitea-mirror commented

2026-05-05 08:28:55 -06:00

Author

Owner

@Vincent43 commented on GitHub (Aug 7, 2019):

Allow running programs only from well-known system directories

This refers executing binaries, while kde vuln is about executing command from shell. To mitigate it you would need to block all shells like sh,bash,zsh..

@Vincent43 commented on GitHub (Aug 7, 2019): > Allow running programs only from well-known system directories This refers executing binaries, while kde vuln is about executing command from shell. To mitigate it you would need to block all shells like sh,bash,zsh..

gitea-mirror commented

2026-05-05 08:28:56 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Aug 7, 2019):

Upstream patches for reference
KDE 5: https://phabricator.kde.org/D22979
KDE 4: https://phabricator.kde.org/D22989

@SkewedZeppelin commented on GitHub (Aug 7, 2019): Upstream patches for reference KDE 5: https://phabricator.kde.org/D22979 KDE 4: https://phabricator.kde.org/D22989

gitea-mirror commented

2026-05-05 08:28:57 -06:00

Author

Owner

@curiosity-seeker commented on GitHub (Aug 10, 2019):

Thanks - and yes, this vulnerability is fixed.

@curiosity-seeker commented on GitHub (Aug 10, 2019): Thanks - and yes, this vulnerability is [fixed](https://kde.org/info/security/advisory-20190807-1.txt).

gitea-mirror commented

2026-05-05 08:28:57 -06:00

Author

Owner

@smitsohu commented on GitHub (Aug 10, 2019):

Just to confirm: If the app used to navigate to the manipulated folder (Dolphin only for example) is firejailed, the exploit runs inside the sandbox, so it can do only what we permit it to do.

But of course removing the feature on KDE's side is the only real solution.

@smitsohu commented on GitHub (Aug 10, 2019): Just to confirm: If the app used to navigate to the manipulated folder (Dolphin only for example) is firejailed, the exploit runs _inside_ the sandbox, so it can do only what we permit it to do. But of course removing the feature on KDE's side is the only real solution.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1809

No description provided.

Rows
Columns