github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2910] [ssh profiles] Cannot perform git operation via SSH #1817

New issue

Closed

opened 2026-05-05 08:29:16 -06:00 by gitea-mirror · 8 comments

gitea-mirror commented

2026-05-05 08:29:16 -06:00

Owner

Originally created by @gjpin on GitHub (Aug 13, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2910

Hi there,
I've run into any issue with the ssh profile and git operations.

Setup:
Arch Linux
+
AppArmor
+
default profiles
+
firejail version 0.9.60
Compile time support:
- AppArmor support is enabled
- AppImage support is enabled
- chroot support is enabled
- file and directory whitelisting support is enabled
- file transfer support is enabled
- networking support is enabled
- overlayfs support is enabled
- private-home support is enabled
- seccomp-bpf support is enabled
- user namespace support is enabled
- X11 sandboxing support is enabled`

Steps to reproduce:

perform a git operation, such as clone, via SSH. eg. git clone git@github.com:netblue30/firejail.git

Result:

The ssh process will hang at password input

After removing ssh and ssh-agent profiles, as well as ssh symlink in /usr/local/bin, the operation proceeded as expected.

Thanks!

Originally created by @gjpin on GitHub (Aug 13, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2910 Hi there, I've run into any issue with the ssh profile and git operations. **Setup:** Arch Linux + AppArmor + default profiles + firejail version 0.9.60 Compile time support: - AppArmor support is enabled - AppImage support is enabled - chroot support is enabled - file and directory whitelisting support is enabled - file transfer support is enabled - networking support is enabled - overlayfs support is enabled - private-home support is enabled - seccomp-bpf support is enabled - user namespace support is enabled - X11 sandboxing support is enabled` **Steps to reproduce:** - perform a git operation, such as clone, via SSH. eg. `git clone git@github.com:netblue30/firejail.git` **Result:** - The ssh process will hang at password input After removing ssh and ssh-agent profiles, as well as ssh symlink in /usr/local/bin, the operation proceeded as expected. Thanks!

gitea-mirror closed this issue

2026-05-05 08:29:17 -06:00

gitea-mirror commented

2026-05-05 08:29:19 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 18, 2019):

I doesn't have this issue, have you firejailed git?

The ssh process will hang at password input

What pw? pinetry?

@rusty-snake commented on GitHub (Aug 18, 2019): I doesn't have this issue, have you firejailed git? > The ssh process will hang at password input What pw? pinetry?

gitea-mirror commented

2026-05-05 08:29:20 -06:00

Author

Owner

@gjpin commented on GitHub (Aug 18, 2019):

Started over from a fresh install and couldn't reproduce the issue.
Must have had something else conflicting. Sorry for the false positive. Thanks

@gjpin commented on GitHub (Aug 18, 2019): Started over from a fresh install and couldn't reproduce the issue. Must have had something else conflicting. Sorry for the false positive. Thanks

gitea-mirror commented

2026-05-05 08:29:21 -06:00

Author

Owner

@alexpyattaev commented on GitHub (Dec 3, 2020):

Same issue here. I believe it has to do with kde SSH askpass GUI or similar, but either way allowing SSH to go through firejail breaks git.
The fix for me seems to be commenting these out:
#dbus-user none
#dbus-system none

@alexpyattaev commented on GitHub (Dec 3, 2020): Same issue here. I believe it has to do with kde SSH askpass GUI or similar, but either way allowing SSH to go through firejail breaks git. The fix for me seems to be commenting these out: #dbus-user none #dbus-system none

gitea-mirror commented

2026-05-05 08:29:22 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Dec 3, 2020):

@alexpyattaev what distro are you on?
Fedora recently pushed a fix for broken connections to Debian servers.
https://src.fedoraproject.org/rpms/openssh/c/6a0769945432900cc01b395e5ba52cba33a2edee?branch=f33

@SkewedZeppelin commented on GitHub (Dec 3, 2020): @alexpyattaev what distro are you on? Fedora recently pushed a fix for broken connections to Debian servers. https://src.fedoraproject.org/rpms/openssh/c/6a0769945432900cc01b395e5ba52cba33a2edee?branch=f33

gitea-mirror commented

2026-05-05 08:29:23 -06:00

Author

Owner

@alexpyattaev commented on GitHub (Dec 16, 2020):

Hi, I am on archlinux. firejail version 0.9.64.

@alexpyattaev commented on GitHub (Dec 16, 2020): Hi, I am on archlinux. firejail version 0.9.64.

gitea-mirror commented

2026-05-05 08:29:24 -06:00

Author

Owner

@CvBeijsterveldt commented on GitHub (Dec 22, 2020):

I'm experiencing the same issue on two different Arch Linux installations, both with KDE, since Firejail 0.9.64 (I didn't have the issue before). I'm using KeepassXC to add the SSH keys to the agent. This gives the following error whenever I try to do something with Git that requires repository access:

git@gitlab.com: Permission denied (publickey,keyboard-interactive).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

When I delete 'ssh' symlink from /usr/local/bin/ the issue is 'solved'. After just removing the KeepassXC profile the problem still persists. The fix that works for @alexpyattaev does not seem to work for me (when done to the SSH profile). Also, interestingly, this problem does not occur on a Pinebook Pro running Manjaro Linux with the same setup (i.e. also using the same KeepassXC database and SSH-agent configuration).

Please let me know if I can do anything to provide more info.

@CvBeijsterveldt commented on GitHub (Dec 22, 2020): I'm experiencing the same issue on two different Arch Linux installations, both with KDE, since Firejail 0.9.64 (I didn't have the issue before). I'm using KeepassXC to add the SSH keys to the agent. This gives the following error whenever I try to do something with Git that requires repository access: ``` git@gitlab.com: Permission denied (publickey,keyboard-interactive). fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. ``` When I delete 'ssh' symlink from `/usr/local/bin/` the issue is 'solved'. After just removing the KeepassXC profile the problem still persists. The fix that works for @alexpyattaev does not seem to work for me (when done to the SSH profile). Also, interestingly, this problem does not occur on a Pinebook Pro running Manjaro Linux with the same setup (i.e. also using the same KeepassXC database and SSH-agent configuration). Please let me know if I can do anything to provide more info.

gitea-mirror commented

2026-05-05 08:29:25 -06:00

Author

Owner

@CvBeijsterveldt commented on GitHub (Dec 24, 2020):

Disregard the above, this apparently has to do with the runuser (which KeepassXC is known not to work nicely with), disabling the following lines

whitelist ${RUNUSER}/keyring/ssh
whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh
include whitelist-runuser-common.inc

solves the issue.

@CvBeijsterveldt commented on GitHub (Dec 24, 2020): Disregard the above, this apparently has to do with the runuser (which KeepassXC is known not to work nicely with), disabling the following lines ``` whitelist ${RUNUSER}/keyring/ssh whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh include whitelist-runuser-common.inc ``` solves the issue.

gitea-mirror commented

2026-05-05 08:29:25 -06:00

Author

Owner

@rusty-snake commented on GitHub (Dec 24, 2020):

What does echo $SSH_AUTH_SOCK show?

@rusty-snake commented on GitHub (Dec 24, 2020): What does `echo $SSH_AUTH_SOCK` show?

gitea-mirror referenced this issue

2026-05-05 10:32:33 -06:00

[PR #4326] [MERGED] cmdline.c: optionally quote the resulting command line #5112

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1817

No description provided.

Rows
Columns