github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2970] ping broken #1858

New issue

Closed

opened 2026-05-05 08:31:48 -06:00 by gitea-mirror · 10 comments

gitea-mirror commented

2026-05-05 08:31:48 -06:00

Owner

Originally created by @rusty-snake on GitHub (Sep 18, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2970

Moved from #2969.

$ ping -c1 github.com
# Works (without firejail)
$ firejail ping -c1 github.com
ping: socket: Die Operation ist nicht erlaubt

firejail: lastet git.

Originally created by @rusty-snake on GitHub (Sep 18, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2970 Moved from #2969. ``` $ ping -c1 github.com # Works (without firejail) $ firejail ping -c1 github.com ping: socket: Die Operation ist nicht erlaubt ``` firejail: lastet git.

gitea-mirror

2026-05-05 08:31:48 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 08:31:51 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 18, 2019):

Fix: force-nonewprivs no in firejail.config.

@blinux45 can you confirm?

@rusty-snake commented on GitHub (Sep 18, 2019): Fix: `force-nonewprivs no` in firejail.config. @blinux45 can you confirm?

gitea-mirror commented

2026-05-05 08:31:52 -06:00

Author

Owner

@blinux45 commented on GitHub (Sep 19, 2019):

Uncommenting force-nonewprivs no in /etc/firejail/firejail.config did not resolve the ping issue.

@blinux45 commented on GitHub (Sep 19, 2019): Uncommenting `force-nonewprivs no` in /etc/firejail/firejail.config did not resolve the ping issue.

gitea-mirror commented

2026-05-05 08:31:53 -06:00

Author

Owner

@blinux45 commented on GitHub (Sep 19, 2019):

I would like to clarify that for me ping worked within firejail until I used "private-bin ping,....".

@blinux45 commented on GitHub (Sep 19, 2019): I would like to clarify that for me ping worked within firejail until I used "private-bin ping,....".

gitea-mirror commented

2026-05-05 08:31:54 -06:00

Author

Owner

@blinux45 commented on GitHub (Sep 19, 2019):

As @smitsohu say /bin is mounted nosuid.
To recap:
Without private-bin, ping works but when private-bin is enabled it doesn't.
Is the mounting of /bin different in both cases? Something else seems to be going on.
Also when ping is copied to /home/myuser/firejail, it doesn't work under firejail.
Outside firejail it works fine.
Is this a mounting problem as well?

@blinux45 commented on GitHub (Sep 19, 2019): > As @smitsohu say /bin is mounted `nosuid`. To recap: Without private-bin, ping works but when private-bin is enabled it doesn't. Is the mounting of /bin different in both cases? Something else seems to be going on. Also when ping is copied to /home/myuser/firejail, it doesn't work under firejail. Outside firejail it works fine. Is this a mounting problem as well?

gitea-mirror commented

2026-05-05 08:31:55 -06:00

Author

Owner

@smitsohu commented on GitHub (Sep 19, 2019):

@blinux45

Without private-bin, ping works but when private-bin is enabled it doesn't.
Is the mounting of /bin different in both cases?

Yes, without private-binit is not nosuid.

Also when ping is copied to /home/myuser/firejail, it doesn't work under firejail.

Did you try with --noprofile? The default profile will prevent any raising of privileges.

Edit: nevermind, there is a ping profile.

@smitsohu commented on GitHub (Sep 19, 2019): @blinux45 > Without private-bin, ping works but when private-bin is enabled it doesn't. Is the mounting of /bin different in both cases? Yes, without `private-bin`it is not nosuid. > Also when ping is copied to /home/myuser/firejail, it doesn't work under firejail. Did you try with `--noprofile`? The default profile will prevent any raising of privileges. Edit: nevermind, there is a ping profile.

gitea-mirror commented

2026-05-05 08:31:57 -06:00

Author

Owner

@blinux45 commented on GitHub (Sep 20, 2019):

To recap, there seems no way to get /bin/ping to work when private-bin is enabled even though ping is explicitly requested.
As in: "--private-bin ping"
Is there an absolute requirement for nosuid to be applied simultaneously with private-bin?
Could nosuid be applied independently (for example nosuid=/bin)?
Enabling/disabling specific commands within /bin seems a separate issue from nosuid.
This is breaking ping.

Regarding /home/myuser/firejail/ping, I use a custom profile --profile=myprofile.
The default profile shouldn't be used in this case. Or is it?
I don't see anything in the custom profile that would block ping from running in /home/myuser/firejail/ping.
In my test case scenario, I invoke a bash shell through firejail (using a custom profile).
if I call ping from within this shell, would the ping profile be used? I would assume a no answer, but it is better to be sure.

@blinux45 commented on GitHub (Sep 20, 2019): To recap, there seems no way to get /bin/ping to work when private-bin is enabled even though ping is explicitly requested. As in: "--private-bin ping" Is there an absolute requirement for nosuid to be applied simultaneously with private-bin? Could nosuid be applied independently (for example nosuid=/bin)? Enabling/disabling specific commands within /bin seems a separate issue from nosuid. This is breaking ping. Regarding /home/myuser/firejail/ping, I use a custom profile --profile=myprofile. The default profile shouldn't be used in this case. Or is it? I don't see anything in the custom profile that would block ping from running in /home/myuser/firejail/ping. In my test case scenario, I invoke a bash shell through firejail (using a custom profile). if I call ping from within this shell, would the ping profile be used? I would assume a no answer, but it is better to be sure.

gitea-mirror commented

2026-05-05 08:31:57 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Sep 20, 2019):

Does --private-bin=sh,bash,ping work for you? It's working for me on Arch.

Of course I'm not sure that allowing shell access within private-bin defeats the whole purpose of private-bin... we have to do it sometimes for profiles (it seems especially on Arch this is needed) but I suspect this is a less-than-ideal scenario.

@Fred-Barclay commented on GitHub (Sep 20, 2019): Does `--private-bin=sh,bash,ping` work for you? It's working for me on Arch. Of course I'm not sure that allowing shell access within private-bin defeats the whole purpose of private-bin... we have to do it sometimes for profiles (it seems especially on Arch this is needed) but I suspect this is a less-than-ideal scenario.

gitea-mirror commented

2026-05-05 08:31:58 -06:00

Author

Owner

@topimiettinen commented on GitHub (Sep 21, 2019):

The problem with allowing setuid in general is that firejail also lets the unprivileged user to manipulate the file system and capabilities, and it could be possible use that to trick the setuid program to leak elevated privileges if there was no protection. It's not possible for firejail to know which changes to file system or capabilities is safe for a specific setuid program or to even know all possible setuid programs.

@topimiettinen commented on GitHub (Sep 21, 2019): The problem with allowing setuid in general is that firejail also lets the unprivileged user to manipulate the file system and capabilities, and it could be possible use that to trick the setuid program to leak elevated privileges if there was no protection. It's not possible for firejail to know which changes to file system or capabilities is safe for a specific setuid program or to even know all possible setuid programs.

gitea-mirror commented

2026-05-05 08:31:58 -06:00

Author

Owner

@Vincent43 commented on GitHub (Sep 21, 2019):

@topimiettinen as I understand this discussion, nosuid is only used for private-bin option so problem with setuid bins is only mitigated in this specific case.

@Vincent43 commented on GitHub (Sep 21, 2019): @topimiettinen as I understand this discussion, `nosuid` is only used for `private-bin` option so problem with setuid bins is only mitigated in this specific case.

gitea-mirror commented

2026-05-05 08:31:59 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 13, 2019):

Closing here. Future discussion about nosuid+private-bin in #2969.

@rusty-snake commented on GitHub (Oct 13, 2019): Closing here. Future discussion about `nosuid`+`private-bin` in #2969.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1858

No description provided.

Rows
Columns