mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3478] evolution: cannot modify/create lock file on Unix mbox spool files #2186
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2186
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @kmotoko on GitHub (Jun 25, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3478
Evolution mail client can be used to read local mails (Standard Unix mbox spool file). Most commonly, these files are stored in /var/mail/.
Bug and expected behavior
When you try to open the local mailbox in
/var/mail/<USERNAME>, it shows the following under the toolbar (not the message specific part of the window):If you try to open a message from the problematic mailbox, it shows the following instead of the message contents.
Please pay attention that it does not show the message contents at all.
Note: There is no
evolution.local, and there is nothing related inglobals.local.To be able to read Unix mbox spool files that belongs to the current user, without any error.
No profile or disabling firejail
What changed calling
firejail --noprofile PROGRAMin a shell?The error did not change.
What changed calling the program by path=without firejail (check
whereis PROGRAM,firejail --list,stat $programpath)?Evolution works as expected.
Reproduce
Steps to reproduce the behavior:
firejail evolutionAnd
Environment
lsb_release -a)firejail --version) exclusive or used git commit (git rev-parse HEAD)What other programs interact with the affected program for the functionality?
None.
Are these listed in the profile?
N/A
Additional context
Other context about the problem like related errors to understand the problem.
Checklist
find / -name 'firejail' 2>/dev/null/fd firejailto locate profiles ie in/usr/local/etc/firejail/PROGRAM.profile)debug output
@ghost commented on GitHub (Jun 25, 2020):
Hi, thanks for reporting this. Looks like a bug in the profile. Can you try adding
writable-varand report back if that fixes things on your side please?@kmotoko commented on GitHub (Jun 25, 2020):
@glitsj16 that does not solve it. Is
/varrestricted to read-only even with--noprofile, because the error is still present with that flag. Could it be related to firejail apparmor profile?@ghost commented on GitHub (Jun 25, 2020):
That's possible. To test if AppArmor is involved you can either use the
--ignore=apparmorflag or add the below to /etc/apparmor.d/local/firejail-local@rusty-snake commented on GitHub (Jun 25, 2020):
Yes, try with both
--noprofileand--writeble-var.Referring to thunderbird and mutt, you need to
noblacklistandwhitelist(ifinclude whitelist-var-common.inc).@kmotoko commented on GitHub (Jun 26, 2020):
@rusty-snake , running with both
--noprofile --writable-varworked! But the weird thing is that if I putwritable-varinto the local config, it did not. Then I checked--debug, and saw:Mounting read-only /var. It seems like it does not obey thelocalprofile for some reason, to be sure I commented out everything (exceptnoblackliststuff) in thedefaultprofile and it did not change anything.Edit: I also tried the
localprofile with @glitsj16 's apparmor rule, nothing changed.@rusty-snake commented on GitHub (Jun 27, 2020):
If you run
firejail evolution, firejail will use evolution.profile and not the default profile. You need to add it there and try to comment there if it does not work. You see the profiles loaded by firejail in the terminal.@kmotoko commented on GitHub (Jun 27, 2020):
@rusty-snake you got me wrong, I meant the default profile for evolution i.e.
evolution.profile. So in detail here is the thing:firejail --debug --noprofile --writable-var /usr/bin/evolutionresults in evolution to read local mail without any problems. Also, in the debug output, I don't see that/varis mounted read-only.debug output
Autoselecting /bin/bash as shell
Building quoted command line: '/usr/bin/evolution'
Command name #evolution#
DISPLAY=:0 parsed as 0
Using the local network stack
Parent pid 627185, child pid 627186
Initializing child process
Host network configured
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Creating empty /run/firejail/mnt/seccomp directory
Creating empty /run/firejail/mnt/seccomp/seccomp.protocol file
Creating empty /run/firejail/mnt/seccomp/seccomp.postexec file
IBUS_ADDRESS=unix:abstract=/home//.cache/ibus/dbus-cr0HGqtN,guid=9477ce0faa446173f68c34b95ee65c1c
IBUS_DAEMON_PID=6816
Mounting /proc filesystem representing the PID namespace
Basic read-only filesystem:
Mounting read-only /etc
Mounting noexec /etc
Mounting read-only /bin
Mounting read-only /sbin
Mounting read-only /lib
Mounting read-only /lib64
Mounting read-only /lib32
Mounting read-only /libx32
Mounting read-only /usr
Mounting tmpfs on /var/lock
Mounting tmpfs on /var/tmp
Mounting tmpfs on /var/log
Mounting tmpfs on /var/lib/dhcp
Mounting tmpfs on /var/lib/snmp
Mounting tmpfs on /var/lib/sudo
Create the new utmp file
Mount the new utmp file
Cleaning /home directory
Cleaning /run/user directory
Sanitizing /etc/passwd, UID_MIN 1000
Sanitizing /etc/group, GID_MIN 1000
Disable /run/firejail/network
Disable /run/firejail/bandwidth
Disable /run/firejail/name
Disable /run/firejail/profile
Disable /run/firejail/x11
Mounting read-only /proc/sys
Remounting /sys directory
Disable /sys/firmware
Disable /sys/hypervisor
Disable /sys/power
Disable /sys/kernel/debug
Disable /sys/kernel/vmcoreinfo
Disable /sys/kernel/uevent_helper
Disable /proc/sys/fs/binfmt_misc
Disable /proc/sys/kernel/core_pattern
Disable /proc/sys/kernel/modprobe
Disable /proc/sysrq-trigger
Disable /proc/sys/kernel/hotplug
Disable /proc/sys/vm/panic_on_oom
Disable /proc/irq
Disable /proc/bus
Disable /proc/sched_debug
Disable /proc/timer_list
Disable /proc/kcore
Disable /proc/kallsyms
Disable /usr/lib/modules (requested /lib/modules)
Disable /usr/lib/debug
Disable /boot
Disable /dev/port
Disable /run/user/1000/gnupg
Disable /run/user/1000/systemd
Disable /dev/kmsg
Disable /proc/kmsg
Disable /sys/fs
Disable /sys/module
Mounting noexec /run/firejail/mnt/pulse
Mounting /run/firejail/mnt/pulse on /home//.config/pulse
2067 2042 0:103 /pulse /home//.config/pulse rw,nosuid,nodev,noexec - tmpfs tmpfs rw,mode=755
mountid=2067 fsname=/pulse dir=/home//.config/pulse fstype=tmpfs
Current directory: /home/
DISPLAY=:0 parsed as 0
Mounting read-only /run/firejail/mnt/seccomp
Drop privileges: pid 1, uid 1000, gid 1000, nogroups 0
starting application
LD_PRELOAD=(null)
Running '/usr/bin/evolution' command through /bin/bash
execvp argument 0: /bin/bash
execvp argument 1: -c
execvp argument 2: '/usr/bin/evolution'
Child process initialized in 14.78 ms
monitoring pid 2
evolution.profileandevolution.local, althoughwritable-varis present, runningfirejail --debug /usr/bin/evolutionstill gives the error, and in thedebugoutput I can see that/varis still mounted read-only for some reason.evolution.profile:evolution.local:debug output
Autoselecting /bin/bash as shell
Building quoted command line: '/usr/bin/evolution'
Command name #evolution#
Found evolution.profile profile in /etc/firejail directory
Reading profile /etc/firejail/evolution.profile
Found evolution.local profile in /etc/firejail directory
Found globals.local profile in /etc/firejail directory
DISPLAY=:0 parsed as 0
Using the local network stack
Parent pid 627510, child pid 627511
Initializing child process
Host network configured
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Creating empty /run/firejail/mnt/seccomp directory
Creating empty /run/firejail/mnt/seccomp/seccomp.protocol file
Creating empty /run/firejail/mnt/seccomp/seccomp.postexec file
IBUS_ADDRESS=unix:abstract=/home//.cache/ibus/dbus-cr0HGqtN,guid=9477ce0faa446173f68c34b95ee65c1c
IBUS_DAEMON_PID=6816
Mounting /proc filesystem representing the PID namespace
Basic read-only filesystem:
Mounting read-only /etc
Mounting noexec /etc
Mounting read-only /var
Mounting noexec /var
Mounting read-only /bin
Mounting read-only /sbin
Mounting read-only /lib
Mounting read-only /lib64
Mounting read-only /lib32
Mounting read-only /libx32
Mounting read-only /usr
Mounting tmpfs on /var/lock
Mounting tmpfs on /var/tmp
Mounting tmpfs on /var/log
Mounting tmpfs on /var/lib/dhcp
Mounting tmpfs on /var/lib/snmp
Mounting tmpfs on /var/lib/sudo
Create the new utmp file
Mount the new utmp file
Cleaning /home directory
Cleaning /run/user directory
Sanitizing /etc/passwd, UID_MIN 1000
Sanitizing /etc/group, GID_MIN 1000
Disable /run/firejail/network
Disable /run/firejail/bandwidth
Disable /run/firejail/name
Disable /run/firejail/profile
Disable /run/firejail/x11
Mounting read-only /proc/sys
Remounting /sys directory
Disable /sys/firmware
Disable /sys/hypervisor
Disable /sys/power
Disable /sys/kernel/debug
Disable /sys/kernel/vmcoreinfo
Disable /sys/kernel/uevent_helper
Disable /proc/sys/fs/binfmt_misc
Disable /proc/sys/kernel/core_pattern
Disable /proc/sys/kernel/modprobe
Disable /proc/sysrq-trigger
Disable /proc/sys/kernel/hotplug
Disable /proc/sys/vm/panic_on_oom
Disable /proc/irq
Disable /proc/bus
Disable /proc/sched_debug
Disable /proc/timer_list
Disable /proc/kcore
Disable /proc/kallsyms
Disable /usr/lib/modules (requested /lib/modules)
Disable /usr/lib/debug
Disable /boot
Disable /dev/port
Disable /run/user/1000/gnupg
Disable /run/user/1000/systemd
Disable /dev/kmsg
Disable /proc/kmsg
Disable /sys/fs
Disable /sys/module
Mounting noexec /run/firejail/mnt/pulse
Mounting /run/firejail/mnt/pulse on /home//.config/pulse
2069 2044 0:103 /pulse /home//.config/pulse rw,nosuid,nodev,noexec - tmpfs tmpfs rw,mode=755
mountid=2069 fsname=/pulse dir=/home//.config/pulse fstype=tmpfs
Current directory: /home/
DISPLAY=:0 parsed as 0
Mounting read-only /run/firejail/mnt/seccomp
Drop privileges: pid 1, uid 1000, gid 1000, nogroups 0
starting application
LD_PRELOAD=(null)
Running '/usr/bin/evolution' command through /bin/bash
execvp argument 0: /bin/bash
execvp argument 1: -c
execvp argument 2: '/usr/bin/evolution'
Child process initialized in 13.16 ms
monitoring pid 2
@kmotoko commented on GitHub (Jun 27, 2020):
Hmm, I think I accidentality found something out. I realized that I could
cat evolution.profilewithoutsudo, but notcat evolution.profile.ls -l /etc/firejail/evolution.localgives-rw-r----- 1 root root 110 Jun 27 01:41 /etc/firejail/evolution.localbutls -l /etc/firejail/evolution.profilegives-rw-r--r-- 1 root root 932 Jun 27 19:13 /etc/firejail/evolution.profile. Then, I changed the local profile to644and it worked!So I assume that firejail cannot read the local profile with these permissions, but why? Should not it belong to root, why the
others' permission affect it? Also, firejail debug tells nothing about the local profile not being readable.FYI, in my system
DIR_MODE=0750in/etc/adduser.confandUMASK 027in/etc/login.defs. These are not super strict, and I assume not uncommon among security-conscious people.@rusty-snake commented on GitHub (Jun 27, 2020):
A file with 640 root:root can not be readed by a user (as you expect). So if you start firejail as user (not root or sudo) it can not read this profile. If you now wonder why firejail can not read it although it is a SUID, firejail drops it EUID to non-root for things like profile-parsing, ... . (Or better: it has only a EUID=0 for things which need it).
@rusty-snake commented on GitHub (Jun 27, 2020):
If
foobar.inccan not be included (don't exist, permission, ...) firejail will fail.If
foobaz.localcan not be included it is ignored.Changing the later one to emit warnings for e.g. EPERM sounds reasonable.
@rusty-snake commented on GitHub (Jun 27, 2020):
Maybe something like this:
@reinerh commented on GitHub (Sep 12, 2020):
@rusty-snake If I can see it correctly, everytime an error message is printed, firejail exits afterwards.
The reason is probably because of "quiet", as we don't want to print something if firejail can start normally.
I think if a .local file exists but has wrong permissions, we should also exit, so the user can fix it.
I would suggest something like this:
@netblue30 commented on GitHub (Oct 19, 2020):
Went with @reinerh code above, thanks.