github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3285] nslookup apparmor denied #2062

New issue

Closed

opened 2026-05-05 08:44:10 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 08:44:10 -06:00

Owner

Originally created by @ghost on GitHub (Mar 19, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3285

Tested the newly introduced nslookup profile and seeing this in /var/log/audit/audit.log:

type=AVC msg=audit(1584599238.923:1362): apparmor="DENIED" operation="open" profile="firejail-default" name="/proc/10/task/11/comm" pid=46733 comm="nslookup" requested_mask="w" denied_mask="w" fsuid=1001 ouid=1001

Not sure if we need to adapt firejail-default or drop the apparmor option in the profile.

Originally created by @ghost on GitHub (Mar 19, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3285 Tested the newly introduced `nslookup` profile and seeing this in /var/log/audit/audit.log: ``` type=AVC msg=audit(1584599238.923:1362): apparmor="DENIED" operation="open" profile="firejail-default" name="/proc/10/task/11/comm" pid=46733 comm="nslookup" requested_mask="w" denied_mask="w" fsuid=1001 ouid=1001 ``` Not sure if we need to adapt firejail-default or drop the apparmor option in the profile.

gitea-mirror closed this issue

2026-05-05 08:44:11 -06:00

gitea-mirror commented

2026-05-05 08:44:13 -06:00

Author

Owner

@Vincent43 commented on GitHub (Mar 19, 2020):

I've seen this before with qemu. For me it would be ok to add /proc/@{PID}/task/@{PID}/comm w, line to firejail-default.

@Vincent43 commented on GitHub (Mar 19, 2020): I've seen this before with qemu. For me it would be ok to add `/proc/@{PID}/task/@{PID}/comm w,` line to firejail-default.

gitea-mirror commented

2026-05-05 08:44:14 -06:00

Author

Owner

@ghost commented on GitHub (Mar 19, 2020):

@Vincent43 Thanks. I've added that to my firejail-local for now and it does the job. Let's keep this open for a while so others can chime in. Cheers!

@ghost commented on GitHub (Mar 19, 2020): @Vincent43 Thanks. I've added that to my firejail-local for now and it does the job. Let's keep this open for a while so others can chime in. Cheers!

gitea-mirror commented

2026-05-05 08:44:15 -06:00

Author

Owner

@netblue30 commented on GitHub (Mar 19, 2020):

It does the same for dig and (bind9) host. "/proc/@{PID}/task/@{PID}/comm w" works fine. I'm putting it in git. I'll be adding lots of apparmor in the existing profiles.

8a820b48de

@netblue30 commented on GitHub (Mar 19, 2020): It does the same for dig and (bind9) host. "/proc/@{PID}/task/@{PID}/comm w" works fine. I'm putting it in git. I'll be adding lots of apparmor in the existing profiles. 8a820b48dec5684ace55b44ba0c041b37eaf021a

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2062

No description provided.

Rows
Columns