mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3530] disable-shell.inc breaks AppImages #2220
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2220
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @svc88 on GitHub (Jul 20, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3530
Bug and expected behavior
When i upgraded to 0.9.63 from 0.9.62, i started having issues with keepassxc appimage.
The appimage didnt open up keepassxc, instead i saw an error in the log saying:
No profile or disabling firejail
firejail --noprofile PROGRAMin a shell?It runs
Environment
a9aabada2fAdditional context
This didnt happen with 0.9.62
@svc88 commented on GitHub (Jul 20, 2020):
If i run the appimage like so:
firejail ./KeePassXC-2.5.4-x86_64.AppImagei get this error (if it helps) not sure what execv is?
execv error: No such file or directoryPossibly related to https://github.com/netblue30/firejail/issues/2690 ?
@rusty-snake commented on GitHub (Jul 20, 2020):
Where is the AI stored?
To sum-up:
@svc88 commented on GitHub (Jul 20, 2020):
Do you mean where do i run it from? just from $HOME
Yes exactly. Not sure if this is related to the issue i mentioned.
@rusty-snake commented on GitHub (Jul 20, 2020):
The last may work with
firejail '--ignore=noexec ${HOME}' --profile=keepassxc ./KeePassXC-2.5.4-x86_64.AppImage.@svc88 commented on GitHub (Jul 20, 2020):
firejail '--ignore=noexec ${HOME}' --profile=keepassxc ./KeePassXC-2.5.4-x86_64.AppImage
@bbhtt commented on GitHub (Jul 20, 2020):
Comment
include disable-shell.incand runfirejail --profile=/home/korte/firejail/etc/profile-a-l/keepassxc.profile --appimage KeePassXC-2.6.0-x86_64.AppImage, works for me. Appimage is in/home/korte,firejail from git master.@svc88 commented on GitHub (Jul 20, 2020):
@kortewegdevries thank you, it works. What is the significance of
include disable-shell.inc? And why isnt it working with it enabled?@svc88 commented on GitHub (Jul 20, 2020):
Also if we disable it, what are the security risks?
@rusty-snake commented on GitHub (Jul 20, 2020):
My question: Why does it work?!! There is no shell in its private-bin!
@svc88 commented on GitHub (Jul 20, 2020):
@rusty-snake so is this a bug? If i keep it disabled will that mean that the sandbox is less secure?
@smitsohu commented on GitHub (Jul 21, 2020):
The reason is that
private-binandprivate-libare disabled whenappimageis enabled. This doesn't seem to be documented in the man pages, which is a bug in my opinion.fb145c33eb/src/firejail/sandbox.c (L910-L911)fb145c33eb/src/firejail/sandbox.c (L930-L931)That's probably because, the way it works right now, a shell is needed to run the AppImage.
@smitsohu commented on GitHub (Jul 21, 2020):
Maybe it would be good if Firejail could also print a warning.
@rusty-snake commented on GitHub (Jul 21, 2020):
Can we do something like this?
https://github.com/netblue30/firejail/blob/master/src/firejail/profile.c#L1615
@bbhtt commented on GitHub (Jul 21, 2020):
Then is there a point in adding
?HAS_APPIMAGE: ignore private-binto a profile?@rusty-snake commented on GitHub (Jul 21, 2020):
@smitsohu commented on GitHub (Jul 24, 2020):
@svc88 Security does not degrade with regards to 0.9.62. As a matter of fact a shell is needed currently, so there is no degree of freedom anyway.
@rusty-snake commented on GitHub (Jul 25, 2020):
I tried my Idea and it is not working (as I expected).
firejail --profile=keepassxc --appimage KeePassXC-2.6.0-x86_64.AppImagewill first read keepassxc.profile and the setarg_appimage = 1.skip-disable-shell-if-appimage.patch
@netblue30 @smitsohu This fact make me thinking about
?HAS_APPIMAGE:.firejail -profile=kpxc.profile --appimage KeePassXC-2.6.0-x86_64.AppImageis broken! This means?HAS_APPIMAGE:is broken withfirejail [OPTIONS] --appimage [appimage-file and arguments].kpxc.profile:@bbhtt commented on GitHub (Aug 1, 2020):
Add an option --allow-shell (arg_allow_shell) and force it whenever arg_appimage is set and skip like 1633-1641?
@rusty-snake commented on GitHub (Aug 1, 2020):
--allow-shellcould be confusing (comparing toshell none, does it supportprivate-bin, ...). For what is it good?@bbhtt commented on GitHub (Aug 2, 2020):
arg_shell_none = 0is already set when--appimageis specified? Andshell noneexecutes by path,different fromallow shellwhich would allow shell inside a sandbox? What other way to ignore a line "include" from profile? Print a warning and exit like smitsohu said I guess.@rusty-snake commented on GitHub (Aug 4, 2020):
patch and
ignore🙄 🤣https://github.com/netblue30/firejail/issues/2153#issuecomment-609049079
Obvious patching is no solution for the majority, but it would be nice to have this patch in (after someone provided feedback).
@smitsohu commented on GitHub (Sep 2, 2020):
Should we go through the conditionals after all command line and profile processing? Then, with
102f8d1fdcin , this bug could be solved just by updating the profiles. It also would avoid #3358 and similar problems.@rusty-snake commented on GitHub (Sep 2, 2020):
👍
Where do you want to add
?HAS_APPIMAGE: ignore …? In globals.local?@smitsohu commented on GitHub (Sep 2, 2020):
Turns out it's not so straightforward with
noblacklistandignoreand so on, obviously applying them at the very end doesn't make much sense. So one would need to parse them late, but push the commands in front. Then it also wouldn't matter where?HAS_APPIMAGE: ignore include disable-shell.incgoes. Crazy or reasonable? I'm not sure anymore.@smitsohu commented on GitHub (Sep 2, 2020):
Or we do go through the conditionals at the end, after all other command line and profile options, and offer negated conditionals in addition to what we have now, something like
?HAS_NO_APPIMAGE:This would sacrifice some flexibility, but make a cleaner interface. There could be a
?HAS_NO_APPIMAGE: include disable-shell.incor similar line in the profiles.Honestly I'm somewhat at a loss what to do here.
@rusty-snake commented on GitHub (Sep 22, 2020):
For now we could enforce that
--profileis used after--appimage. The general issue with conditions can be then solved later.@netblue30 commented on GitHub (Oct 1, 2020):
Fixed! We were doing something similar for --allow-debuggers and disable-devel.inc. Give it a try, thanks.