[GH-ISSUE #2905] Potential leakage in quiet option #1814

New issue

Closed

opened 2026-05-05 08:29:08 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 08:29:08 -06:00

Owner

Originally created by @ghost on GitHub (Aug 13, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2905

Commit 7b37c90240 triggered my curiosity because it introduced the quiet option twice in gzip archiver redirect profiles and I assumed it might break stuff. But to my surprise it didn't. After some more testing, this is what I'm observing with firejail from git master.

Placement is (still) important and might leak output:

comment quiet in bunzip2.profile (included gzip.profile still has it)

$ time -p -f '%e' firejail /usr/bin/bunzip2 test.bz2
Reading profile /etc/firejail/bunzip2.profile
0.68

uncomment quiet in bunzip2.profile (included gzip.profile still has it)

$ time -p -f '%e' firejail /usr/bin/bunzip2 test.bz2
0.52

This validates the double include of the quiet option in 7b37c90240, which doesn't seem to have any/much negative impact. It also suggests we could close any potential output leakage of the quiet option in other (mainly archiver redirect) profiles in similar manner. Are there any objections, observations, comments on this?

Originally created by @ghost on GitHub (Aug 13, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2905 Commit https://github.com/netblue30/firejail/commit/7b37c90240d760d2ce6a73e11f3e9a12edeb5955 triggered my curiosity because it introduced the `quiet` option twice in gzip archiver redirect profiles and I assumed it might break stuff. But to my surprise it didn't. After some more testing, this is what I'm observing with firejail from git master. Placement is (still) important and might leak output: - comment `quiet` in bunzip2.profile (included gzip.profile still has it) ``` $ time -p -f '%e' firejail /usr/bin/bunzip2 test.bz2 Reading profile /etc/firejail/bunzip2.profile 0.68 ``` - uncomment `quiet` in bunzip2.profile (included gzip.profile still has it) ``` $ time -p -f '%e' firejail /usr/bin/bunzip2 test.bz2 0.52 ``` This validates the double include of the `quiet` option in https://github.com/netblue30/firejail/commit/7b37c90240d760d2ce6a73e11f3e9a12edeb5955, which doesn't seem to have any/much negative impact. It also suggests we could close any potential output leakage of the `quiet` option in other (mainly archiver redirect) profiles in similar manner. Are there any objections, observations, comments on this?

gitea-mirror closed this issue

2026-05-05 08:29:09 -06:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1814

No description provided.

Rows
Columns