github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3492] Suggestion: add --nsswitch-file option to better control name resolution #2199

New issue

Open

opened 2026-05-05 08:52:46 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 08:52:46 -06:00

Owner

Originally created by @95440b97d on GitHub (Jul 4, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3492

Hello,

I'm trying to better control/isolate DNS requests.

Firejail offers the --dns option to set a custom DNS server which creates an appropriate resolves.conf file with a nameserver entry. However, this alone is not enough as the order in which name resolution services are engaged is controlled by the nsswitch.conf file.

Perhaps we can add a --nsswitch-file option (in the same sense as the --host-file option) to have a custom nsswitch.conf file to be copied into the sandbox?

What are your thoughts?

Originally created by @95440b97d on GitHub (Jul 4, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3492 Hello, I'm trying to better control/isolate DNS requests. Firejail offers the --dns option to set a custom DNS server which creates an appropriate resolves.conf file with a nameserver entry. However, this alone is not enough as the order in which name resolution services are engaged is controlled by the nsswitch.conf file. Perhaps we can add a --nsswitch-file option (in the same sense as the --host-file option) to have a custom nsswitch.conf file to be copied into the sandbox? What are your thoughts?

gitea-mirror added the

enhancement

networking

labels 2026-05-05 08:52:46 -06:00

gitea-mirror commented

2026-05-05 08:52:48 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 16, 2020):

My concerns are that nsswitch.conf also controls things such as passwd.

@rusty-snake commented on GitHub (Jul 16, 2020): My concerns are that nsswitch.conf also controls things such as passwd.

gitea-mirror commented

2026-05-05 08:52:49 -06:00

Author

Owner

@rusty-snake commented on GitHub (Dec 6, 2020):

--dns=1.2.3.4 is broken on Fedora 33 if the sandbox has system-bus access (e.g. neither dbus-system filter nor dbus-system none is used). That's because systemd-resolve is now the default and nss-resolve is used by default (ubuntu still has nss-dns as default IIRC).

nsswitch.conf hosts line now looks like this:
hosts: files mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] myhostname dns
Which translate to this:
/etc/hosts, Zeroconf, systemd-resolved (via D-Bus), myhostname, /etc/resolv.conf

Therefore any call to getaddrinfo tries resolved first.

Workarounds:

dbus-system filter or dbus-system none
remove resolve [!UNAVAIL=return]

Suggestion:

We should remove resolve [!UNAVAIL=return] inside the sandbox.

@rusty-snake commented on GitHub (Dec 6, 2020): `--dns=1.2.3.4` is broken on Fedora 33 if the sandbox has system-bus access (e.g. neither `dbus-system filter` nor `dbus-system none` is used). That's because systemd-resolve is now the default and nss-resolve is used by default (ubuntu still has nss-dns as default IIRC). nsswitch.conf hosts line now looks like this: `hosts: files mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] myhostname dns` Which translate to this: `/etc/hosts`, Zeroconf, systemd-resolved (via D-Bus), myhostname, `/etc/resolv.conf` Therefore any call to getaddrinfo tries resolved first. Workarounds: 1. `dbus-system filter` or `dbus-system none` 2. remove `resolve [!UNAVAIL=return]` Suggestion: We should remove `resolve [!UNAVAIL=return]` inside the sandbox.

gitea-mirror commented

2026-05-05 08:52:50 -06:00

Author

Owner

@sak96 commented on GitHub (Feb 8, 2022):

We should remove resolve [!UNAVAIL=return] inside the sandbox.

can this be tested. /etc/nsswitch.conf is non editable file within the sandbox.

@sak96 commented on GitHub (Feb 8, 2022): We should remove resolve [!UNAVAIL=return] inside the sandbox. can this be tested. `/etc/nsswitch.conf` is non editable file within the sandbox.

gitea-mirror referenced this issue

2026-05-05 10:15:59 -06:00

[PR #2199] [MERGED] Fix #2142: Firefox appimage fails because it needs non-default seccomp #4220

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2199

No description provided.

Rows
Columns