mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3153] Whois not working #1980
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1980
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @aminvakil on GitHub (Jan 16, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3153
resolv.confis needed to resolve whois.ripe.net.Also
gconvlibrary is needed for whois to work properly.Also whois requests these additional libraries below which it's been shown on strace, but as far as I tested whois is working properly without those libraries.
@ghost commented on GitHub (Jan 17, 2020):
@aminvakil Thanks for reporting this. I have been trying to reproduce on Arch (which I assume you're seeing this on due to https://bugs.archlinux.org/task/65182). I have a few questions, as, for now, I haven't been able to reproduce:
what firejail version are you using? There have been recent changes in the profile. It would be helpful if you could redo your strace tests with the most recent profile too.
do you use firecfg? This is important, because if you do there should be a symlink at /usr/local/bin/whois. If so, IMHO using 'firejail ... whois' in your strace examples would be incorrect and could explain why I cannot reproduce when redoing the examples with /usr/bin/whois.
For comparison, here is what I see when re-running your strace examples. Basically I get the exact same output with all 3 examples, suggesting the profile from git master works fine as is.
$ firejail --profile=whois --allow-debuggers --private-bin=strace strace -e trace=open,openat /usr/bin/whois 185.121.130.130
$ firejail --profile=whois --allow-debuggers --private-bin=strace --private-etc=resolv.conf strace -e trace=open,openat /usr/bin/whois 185.121.130.130
$ firejail --profile=whois --allow-debuggers --private-bin=strace --private-etc=resolv.conf --private-lib=gconv,libnss_mymachines.so*,libnss_myhostname.so*,libnss_resolve.so*,libresolv.so* strace -e trace=open,openat /usr/bin/whois 185.121.130.130
@rusty-snake commented on GitHub (Jan 17, 2020):
@aminvakil @glitsj16
firejail --trace=whois.trace --private-etc=resolv.conf whois 1.2.3.4and after thatgrep -E ":open(at)? " whois.traceis much simpler.@aminvakil commented on GitHub (Jan 17, 2020):
Yes, I'm using firecfg, but as I though executing /usr/local/bin/whois is not different from executing /usr/bin/whois with whois.profile.
Also I'm using the latest whois.profile from this git repo, although the latest whois.profile from Archlinux package makes problem with libraries as well, as far I realized difference from Archlinux whois.profile and this repo whois.profile is the error which this repo whois.profile gives related to resolv.conf.
I've tested again with /usr/bin/whois and output is the same.
@aminvakil commented on GitHub (Jan 17, 2020):
Output:
firejail --profile=/etc/firejail/whois.profile --private-bin=strace --allow-debuggers strace -e trace=open,openat /usr/bin/whois 185.121.130.130 openat(AT_FDCWD, "/etc/ld.so.preload", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/run/firejail/lib/libtracelog.so", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/tls/haswell/x86_64/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/tls/haswell/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/tls/x86_64/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/tls/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/haswell/x86_64/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/haswell/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/x86_64/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/libidn2.so.0", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/libunistring.so.2", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/run/firejail/mnt/fslogger", O_RDONLY) = 3 openat(AT_FDCWD, "/usr/lib/charset.alias", O_RDONLY|O_NOFOLLOW) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/whois.conf", O_RDONLY) = 3 openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/etc/services", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/gconv/gconv-modules.cache", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/gconv/gconv-modules", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/host.conf", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/libnss_dns.so.2", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/libresolv.so.2", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/share/locale/locale.alias", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/share/locale/en_US.UTF-8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/share/locale/en_US.utf8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/share/locale/en_US/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/share/locale/en.UTF-8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/share/locale/en.utf8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/share/locale/en/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory) getaddrinfo(whois.ripe.net): Name or service not known +++ exited with 2 +++firejail --profile=/etc/firejail/whois.profile --private-etc=resolv.conf --private-bin=strace --private-lib=gconv --allow-debuggers strace -e trace=open,openat /usr/bin/whois 185.121.130.130 openat(AT_FDCWD, "/etc/ld.so.preload", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/run/firejail/lib/libtracelog.so", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/tls/haswell/x86_64/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/tls/haswell/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/tls/x86_64/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/tls/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/haswell/x86_64/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/haswell/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/x86_64/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/libidn2.so.0", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/libunistring.so.2", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/run/firejail/mnt/fslogger", O_RDONLY) = 3 openat(AT_FDCWD, "/usr/lib/charset.alias", O_RDONLY|O_NOFOLLOW) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/whois.conf", O_RDONLY) = 3 openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/etc/services", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/gconv/gconv-modules.cache", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/gconv/gconv-modules", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/host.conf", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/libnss_dns.so.2", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/libresolv.so.2", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/etc/gai.conf", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/gconv/ISO8859-1.so", O_RDONLY|O_CLOEXEC) = 4 % This is the RIPE Database query service. ... % This query was served by the RIPE Database Query Service version 1.96 (HEREFORD) +++ exited with 0 +++firejail --profile=/etc/firejail/whois.profile --private-etc=resolv.conf --private-bin=strace --private-lib=gconv,libnss_mymachines.so*,libnss_myhostname.so*,libnss_resolve.so*,libresolv.so* --allow-debuggers strace -e trace=open,openat /usr/bin/whois 185.121.130.130 openat(AT_FDCWD, "/etc/ld.so.preload", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/run/firejail/lib/libtracelog.so", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/tls/haswell/x86_64/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/tls/haswell/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/tls/x86_64/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/tls/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/haswell/x86_64/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/haswell/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/x86_64/libidn2.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/libidn2.so.0", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/libunistring.so.2", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/run/firejail/mnt/fslogger", O_RDONLY) = 3 openat(AT_FDCWD, "/usr/lib/charset.alias", O_RDONLY|O_NOFOLLOW) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/whois.conf", O_RDONLY) = 3 openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/etc/services", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/gconv/gconv-modules.cache", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/gconv/gconv-modules", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/host.conf", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/libnss_dns.so.2", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/usr/lib/libresolv.so.2", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/etc/gai.conf", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/gconv/ISO8859-1.so", O_RDONLY|O_CLOEXEC) = 4 % This is the RIPE Database query service. ... % This query was served by the RIPE Database Query Service version 1.96 (HEREFORD) +++ exited with 0 +++@rusty-snake commented on GitHub (Jan 17, 2020):
Have you a whois.local / globals.local?
@aminvakil commented on GitHub (Jan 17, 2020):
No.
@aminvakil commented on GitHub (Jan 17, 2020):
This doesn't output anything extra:
firejail --trace=whois.trace --private-etc=resolv.conf /usr/bin/whois 185.121.130.130 iconv_open: Invalid argumentAlso an interesting thing I realized now is
whois 1.2.3.4works, butwhois 185.121.130.130not.I've seen some other IPs before which doesn't have problem and queries correctly, but I can't understand the pattern yet.
@rusty-snake commented on GitHub (Jan 17, 2020):
@aminvakil this is an alternative to the complex strace line. Adding
--private-lib=gconvand what else is needed will help. My intention was the workflow, not the full cmd for whois.@ghost commented on GitHub (Jan 19, 2020):
@aminvakil That's weird indeed. Do you see similar results on different IP addresses also without using firejail? How does your DNS setup look like? Anything non-default in your /etc/whois.conf? I'd try different hosts using the whois
--hostflag, in combination with--verbosemode. Just anything really that might show a more precise view on what whois is doing exactly...@aminvakil commented on GitHub (Jan 19, 2020):
My
/etc/whois.confis empty (except default comments).I can't see any problem using whois without firejail.
My
/etc/resolv.confis being managed by NetworkManager and varies from time to time based on my environment, but I really doubt that causes the problem.I've installed firejail from Archlinux repo again which doesn't have `private-etc and goes as below: (I have a question here, if whois doesn't have access to /etc/resolv.conf how should it resolv whois.ripe.net, etc.?)
I tried some IPs (which are typed randomly) which succeed and failed using firejail whois of course as below:
Failed:
Succeed:
Also I'm from Iran and Internet in our country is so messed up, many websites are filter by our own government and many websites are blocked because of sanctions, but I've tested these using proxies in different countries and results are the same. (In case someone notices where I am from:))
@ghost commented on GitHub (Jan 19, 2020):
@aminvakil Thank you for testing and posting results here. After looking at those more carefully, here are my observations:
/etc/whois.conf looks fine, stock Arch defaults
/etc/resolv.conf is being managed by NetworkManager: although there are other options, this should work
Spot on. AFAIK whois guesses the right server to ask for the specified object from an internal database. If a 'guess' fails, it moves on and tries another one. Looking at your failure/succes pattern, some of these 'guesses' always seem to fail, others succeed. To me that suggests something is off with DNS resolution. Wether or not that has anything to do with the current Iranian situation is something I cannot ascertain, sadly enough. But don't despair, we can try a few things!
Have you tried using firejail's --dns option yet? If not, please run some more tests, no need for stracing this time. Especially test the failing IP lookups:
When 1.1.1.1 and 9.9.9.9 do work as expected (with or without specifying a whois host with the -h flag), you can use a whois.local file like the below:
Best of luck!
@aminvakil commented on GitHub (Jan 19, 2020):
I'm going crazy now.
This doesn't work at first, and rest of commands if they didn't redirect to another whois server, worked properly, otherwise they would give the error: iconv_open: Invalid argument
Then I added your whois.local file and everything was fine.
After that I remove whois.local and now everything is OK!!!
I don't know how this gets fixed, does it get cached somewhere? Does it sets as you said in its internal database and maybe in another time if I query from another whois server which wasn't in your commands I will face this error again?
Also I added strace to private-bin again to test and this is very interesting too:
openat(AT_FDCWD, "/usr/lib/gconv/gconv-modules", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/lib/gconv/ISO8859-1.so", O_RDONLY|O_CLOEXEC) = 4
Why whois is permitted to access gconv now?
I'm pretty sure I remove whois.local, I've checked it 10 times and it's not there, I reinstalled firejail and my whois.profile is the same as archlinux repos except strace in private-bin.
I think I'm missing something and I don't want to take your time anymore, therefore I will close this issue, but if you had any idea why gconv is permitted to access again please tell me.
Thank you very much indeed