mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3333] Creating temporary filesystem from shell fails #2094
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2094
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @matu3ba on GitHub (Apr 9, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3333
Describe the bug
Running
firejail --private firefoxor simplyfirejail firefoxie fails withTo Reproduce
firejail firefoxReading profile /usr/local/etc/firejail/firefox.profile
Reading profile /usr/local/etc/firejail/whitelist-usr-share-common.inc
Reading profile /usr/local/etc/firejail/firefox-common.profile
Reading profile /usr/local/etc/firejail/disable-common.inc
Reading profile /usr/local/etc/firejail/disable-devel.inc
Reading profile /usr/local/etc/firejail/disable-exec.inc
Reading profile /usr/local/etc/firejail/disable-interpreters.inc
Reading profile /usr/local/etc/firejail/disable-programs.inc
Reading profile /usr/local/etc/firejail/whitelist-common.inc
Reading profile /usr/local/etc/firejail/whitelist-var-common.inc
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Parent pid 63204, child pid 63205
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: not remounting /run/user/1000/gvfs
Warning: cleaning all supplementary groups
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Child process initialized in 118.04 ms
Error: execute permission denied for /usr/local/bin/firefox
Error: no suitable firefox executable found
Parent is shutting down, bye...
Expected behavior
Firefox should start with a temporary filesystems.
Desktop (please complete the following information):
Manjaro Linux 19.0.2
firejail --version)firejail version 0.9.63
Compile time support:
- AppArmor support is disabled
- AppImage support is enabled
- chroot support is enabled
- file and directory whitelisting support is enabled
- file transfer support is enabled
- firetunnel support is enabled
- networking support is enabled
- overlayfs support is enabled
- private-home support is enabled
- seccomp-bpf support is enabled
- user namespace support is enabled
- X11 sandboxing support is enabled
Additional context
Running
firefoxworks as expected. Mounting of filesystem also works.Last lines of
firejail --debug --private firefoxSearching $PATH for firefox
trying #/home/misterspoon/.cargo/bin/firefox#
trying #/home/misterspoon/.local/bin/firefox#
trying #/usr/local/bin/firefox#
Error: execute permission denied for /usr/local/bin/firefox
Installing /run/firejail/mnt/seccomp/seccomp seccomp filter
Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter
Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter
Error: no suitable firefox executable found
monitoring pid 19
Sandbox monitor: waitpid 19 retval 19 status 256
If this is expected behavior:
What is the new recommended way to start
--privateor--private=DIRfirejail instances?@matu3ba commented on GitHub (Apr 9, 2020):
firejail --noprofile firefoxruns with the expected output@Fred-Barclay commented on GitHub (Apr 9, 2020):
@matu3ba FWIW I have firefox-esr on Debian 10 and unfortunately can't reproduce - does this happen for other programs too or just firefox?
My output for comparison:
EDIT: a few more questions
What's the output of
whereis firefox?Have you run
firecfg? If not sure, check the output offirecfg --listI wonder if perhaps there's an issue/conflict with firejail and firecfg if firejail is installed to
/usr/local/binas seems to be the case here.@Fred-Barclay commented on GitHub (Apr 9, 2020):
Edit 2: try
firejail --private /usr/bin/firefoxIt looks like you have used
firecfgso firefox would be starting in firejail automatically - sofirejail --private firefoxis callingfirejail --privateon an already-firejailed firefox (i.e. attempting to double-sandbox). Hence the issues.Probably someone else can explain it better than me though..
@matu3ba commented on GitHub (Apr 9, 2020):
firejail --private /usr/bin/firefoxworks. Thanks.Are double-sandboxes now forbidden?
Then the output (expecting users to give the absolute path) could be handled better for users than
@matu3ba commented on GitHub (Apr 9, 2020):
whereis firefoxfirefox: /usr/bin/firefox /usr/lib/firefox /usr/local/bin/firefox
firecfg --list | grep firefox/usr/local/bin/firefox
@ghost commented on GitHub (Apr 9, 2020):
Forbidden no, but it sure isn't advised to run firejail like that. If you do, either applications will fail to start, or end up being executed in a sandbox environment that isn't designed for them. In other words, expect breakage just about everywhere.
@Fred-Barclay It sure looks that way. But that doesn't explain why all the firejail files ended up under /usr/local. @matu3ba Did you install firejail from git manually by any chance? I don't think there's an official Manjaro repository that carries firejail 0.9.63. If you show us your PKGBUILD, we can help to un-confuse your setup.
@matu3ba commented on GitHub (Apr 9, 2020):
This contradicts or is unclear regarding advisory from the usage section of the blog.
Yes, I do use the latest git master. The bug report template should ask this.
@ghost commented on GitHub (Apr 9, 2020):
Thanks for clearing that up. If you didn't use the
---prefix=/usrflag, I suggest you do ( see the firejail-git PKGBUILD on AUR for example). On a side-note, if you're going to use firejail from git, it is not uncommon to rebuild several times a day. A compiler cache like ccache can speed things up quite a bit for such a workflow, just a tip.After taking care of all that and reinstalling firejail, you might as well reset all the symlinks firecfg has put in /usr/local/bin too:
Or alternatively use the python script @rusty-snake offered in #2624. When all that is done you should now see expected behaviour when running
firejail firefoxfrom the command line and bring some regained sanity to your system.@rusty-snake commented on GitHub (Apr 9, 2020):
FYI: I use a script to complie and install firejail. Customize as you want.
click me
@matu3ba commented on GitHub (Apr 9, 2020):
Configured with: /build/gcc/src/gcc/configure --prefix=/usr --libdir=/usr/lib --libexecdir=/usr/lib --mandir=/usr/share/man --infodir=/usr/share/info --with-pkgversion='Arch Linux 9.3.0-1' --with-bugurl=https://bugs.archlinux.org/ --enable-languages=c,c++,ada,fortran,go,lto,objc,obj-c++,d --enable-shared --enable-threads=posix --with-system-zlib --with-isl --enable-__cxa_atexit --disable-libunwind-exceptions --enable-clocale=gnu --disable-libstdcxx-pch --disable-libssp --enable-gnu-unique-object --enable-linker-build-id --enable-lto --enable-plugin --enable-install-libiberty --with-linker-hash-style=gnu --enable-gnu-indirect-function --enable-multilib --disable-werror --enable-checking=release --enable-default-pie --enable-default-ssp --enable-cet=auto gdc_include_dir=/usr/include/dlang/gdc
Removing firejail with
sudo make uninstalland building with AUR yields the exact same error on runningfirejail --private firefox.Can you reproduce? If this is intended not to work, it should be documented or better an according user feedback should be given.
@matu3ba commented on GitHub (Apr 9, 2020):
@rusty-snake @glitsj16 Thanks for the build setup recommendations though. Since the AUR is more easily usable for me I tried that one and found no difference.
@rusty-snake Your script looks very nice for digging into options.
@netblue30 commented on GitHub (Apr 10, 2020):
on debian stable:
It works fine if I remove "shell none" from the profile or if provide a full path:
@matu3ba commented on GitHub (Apr 10, 2020):
@netblue30
Yes, but this behavior (of not allowing nested sandboxes) should be added to Desktop integration in the README.md.
And in the best case for users from distributions an according output should be given.
@rusty-snake commented on GitHub (Apr 10, 2020):
As a workaround you can remove /usr/local/bin from $PATH (in the sandbox).
@matu3ba commented on GitHub (Apr 12, 2020):
Since this worked before and users may depend on this behavior, the solution options would be:
etc/firejail/firejail.config@ghost commented on GitHub (Apr 12, 2020):
@matu3ba This was all a bit confusing at first, but this should fix the issue.
@rusty-snake commented on GitHub (Apr 12, 2020):
ca6eec7can be revertedIn the past firejail has shows
Warning: an existing sandbox was detected. /usr/bin/XXX will run without any additional sandboxing featureswhen starting a firecfg symlink, but now it showsbash: /usr/local/bin/XXX: Permission denied. So I bisect this and found0e85136b. The issue here is that gjs is in firecfg.config, therefore the first occurs of gjs in ${PATH} is /usr/local/bin/gjs, which is a symlinl to /usr/bin/firejail. Theblacklist ${PATH}/gjsin0e85136bwill then blacklist /usr/bin/firejail.As a workaround add
noblacklist ${PATH}/gjsin firefox.local (and where else it is needed) or remove /usr/local/bin/gjs.How do we want to fix this?
@ghost commented on GitHub (Apr 12, 2020):
@rusty-snake Nice detective work. I didn't like taking out
shell nonein firefox-common.profile but wasn't aware at the time there was an alternative.I would go with 1, drop gjs from firecfg. That seems to be the least invasive. I would prefer to keep
Warning: an existing sandbox was detected. /usr/bin/XXX will run without any additional sandboxing features, as that is a valuable indication something is wrong in a user's firejail setup. Just me though...@matu3ba commented on GitHub (Apr 12, 2020):
@glitsj16 @rusty-snake I would prefer not removing stuff that contains programs and thus the third option.
In the message the
additional sandboxing featuressound abit vague. Potential unsafe setting/option does sound better to me.The warning could be adapted to:
Warning: Bypassing firecfg $firecfgPATH for loading $BINPATH with the according profile. See #issue@ghost commented on GitHub (Apr 15, 2020):
Almost forgot, I reverted
ca6eec7dcf. Can we close here?@matu3ba commented on GitHub (Apr 15, 2020):
@glitsj16 Tested your revert
c6e77685d4744321d7e0f39b1332c383991bade6.firejail --ignore=shell firefoxworks as expected, butfirejail firefoxandfirejail --private firefoxstill fail.It is abit confusing that the naming in firefox-common.profile is different (
shell none).I have a benchmark running for 1.5 days and would need to restart to definitely confirm though.
Would be nice, if the discussion starting with would be continued elsewhere or a decision be written.
@ghost commented on GitHub (Apr 15, 2020):
Using
--ignore="shell none"should work just the same if that's less confusing for you. All --ignore specifications can be double-quoted like this BTW.@matu3ba Did you remove the
gjssymlink in /usr/local/bin? @rusty-snake's alternative assumes that to be non-existing, which is why it is now dropped from firecfg via2cbdc4399a. At least that's my understanding of the discussion here.Why move it? We're dealing with it right here :-)
@matu3ba commented on GitHub (Apr 15, 2020):
Yes. Also I did move gjs.profile from
/usr/local/etc/firejail, but it still has the error incommit c6e77685d4744321d7e0f39b1332c383991bade6. However I still want to restart tomorrow (due to driver updates after Kernel update), to be sure.Funnily the hash also ends in
bade6.Ah. 👍
@matu3ba commented on GitHub (Apr 17, 2020):
@glitsj16 Nope, still does not work on master (
c6e77685d4).@rusty-snake commented on GitHub (Apr 17, 2020):
firejail --profile=firefox bash -c 'ls -l $(which firefox)'@matu3ba commented on GitHub (Apr 17, 2020):
firejail --profile=firefox bash -c 'ls -l $(which firefox)'@rusty-snake commented on GitHub (Apr 17, 2020):
If you use
--debug, you gettrying #/usr/local/bin/firefox# Warning: an existing sandbox was detected. /usr/bin/firefox will run without any additional sandboxing features?@matu3ba commented on GitHub (Apr 17, 2020):
firejail --debug firefoxfrom commite467bf5be3firejail --shell=none --debug firefoxdoes not complain at all.What I dont understand is why it does not emit
Disable /usr/bin/firefoxor similar. Should this not be emitted in--debug?Also I dont see any
Disable /usr/bin/*or alike on runninggrep -rn "/usr/bin/*" etc.@rusty-snake commented on GitHub (Apr 24, 2020):
Why should it disable firefox?
@matu3ba commented on GitHub (Apr 25, 2020):
Sorry, that was wrong. It should disable
/usr/bindepending on the use case.@rusty-snake commented on GitHub (Apr 25, 2020):
Why do you want to
blacklist /usr/bin?@matu3ba commented on GitHub (Apr 25, 2020):
I dont like the idea some other broken program may be altered to
rsyncmy data over web.@rusty-snake commented on GitHub (Apr 25, 2020):
You can use
blacklist ${PATH}/rsyncto blacklist rsync if you want. In addition you can useprivate-binto restrict the available programs to a whitelisted minimum. (An attacker still can have its own rsync).@smitsohu commented on GitHub (Sep 1, 2020):
Fixed in
e4249dec74?@matu3ba commented on GitHub (Sep 2, 2020):
@smitsohu Indeed fixed with commit
e4249de. Thanks for pointing that out.