github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3352] Firejail doesn't hide set secrets #2104

New issue

Open

opened 2026-05-05 08:47:03 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 08:47:03 -06:00

Owner

Originally created by @mustaqimM on GitHub (Apr 13, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3352

Describe the bug
The application (aria2) sets the secret which normally shows as stars, but when run with firejail, it gets exposed:

Behavior change on disabling firejail
N/A

To Reproduce
Steps to reproduce the behavior:

Run with the command: firejail aria2c --rpc-secret=${RPC_SECRET}
See error

Expected behavior
If possible, firejail should also obfuscate the secret set by the application

Desktop (please complete the following information):

Linux distribution and version (ie output of lsb_release -a)

$❯ lsb_release -a
   LSB Version:    1.0
   Distributor ID: VoidLinux
   Description:    Void Linux
   Release:        rolling
   Codename:       void

Firejail version (output of firejail --version) exclusive or used git commit (git rev-parse HEAD)

$❯  firejail --version
firejail version 0.9.62

Compile time support:
        - AppArmor support is enabled
        - AppImage support is enabled
        - chroot support is enabled
        - file and directory whitelisting support is enabled
        - file transfer support is enabled
        - firetunnel support is enabled
        - networking support is enabled
        - overlayfs support is enabled
        - private-home support is enabled
        - seccomp-bpf support is enabled
        - user namespace support is enabled
        - X11 sandboxing support is enabled

Originally created by @mustaqimM on GitHub (Apr 13, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3352 **Describe the bug** The application (aria2) sets the secret which normally shows as stars, but when run with firejail, it gets exposed: ![image](https://user-images.githubusercontent.com/24436622/79111059-56d51800-7d6b-11ea-84d1-9867580ab19c.png) **Behavior change on disabling firejail** N/A **To Reproduce** Steps to reproduce the behavior: 1. Run with the command: firejail aria2c --rpc-secret=${RPC_SECRET} 2. See error **Expected behavior** If possible, firejail should also obfuscate the secret set by the application **Desktop (please complete the following information):** - Linux distribution and version (ie output of `lsb_release -a`) ``` $❯ lsb_release -a LSB Version: 1.0 Distributor ID: VoidLinux Description: Void Linux Release: rolling Codename: void ``` - Firejail version (output of `firejail --version`) exclusive or used git commit (`git rev-parse HEAD`) ``` $❯ firejail --version firejail version 0.9.62 Compile time support: - AppArmor support is enabled - AppImage support is enabled - chroot support is enabled - file and directory whitelisting support is enabled - file transfer support is enabled - firetunnel support is enabled - networking support is enabled - overlayfs support is enabled - private-home support is enabled - seccomp-bpf support is enabled - user namespace support is enabled - X11 sandboxing support is enabled ```

gitea-mirror added the

enhancement

label 2026-05-05 08:47:03 -06:00

gitea-mirror commented

2026-05-05 08:47:04 -06:00

Author

Owner

@matu3ba commented on GitHub (May 3, 2020):

Does aria2 interact with other programs for this feature and (if you know) in what ways?
What is the output of firejail --debug?

@matu3ba commented on GitHub (May 3, 2020): Does aria2 interact with other programs for this feature and (if you know) in what ways? What is the output of `firejail --debug`?

gitea-mirror commented

2026-05-05 08:47:05 -06:00

Author

Owner

@rusty-snake commented on GitHub (May 3, 2020):

What is the output of firejail --debug?

Why? Its completely unrelated.

Does aria2 interact with other programs for this feature and (if you know) in what ways?

I thing they do some hacks in /proc/self.

@rusty-snake commented on GitHub (May 3, 2020): > What is the output of firejail --debug? Why? Its completely unrelated. > Does aria2 interact with other programs for this feature and (if you know) in what ways? I thing they do some hacks in /proc/self.

gitea-mirror commented

2026-05-05 08:47:07 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 4, 2020):

IDK if we ever want to implement this, because we would need to parse childs args.

labelling as "enhancement" for now.

@rusty-snake commented on GitHub (Jun 4, 2020): IDK if we ever want to implement this, because we would need to parse childs args. labelling as "enhancement" for now.

gitea-mirror referenced this issue

2026-05-05 10:15:07 -06:00

[PR #2104] [MERGED] hardening evince, dbus not needed #4174

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2104

No description provided.

Rows
Columns