[GH-ISSUE #329] security breach? #229

Closed
opened 2026-05-05 05:21:59 -06:00 by gitea-mirror · 7 comments
Owner

Originally created by @nntb2a on GitHub (Feb 27, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/329

Hello
i have firejail version 0.9.38 and Dillo version 3.1-dev in gentoo system, both compiled by clang-3.5.0-r100

with all default configuration i have private-etc ignored by last version of dillo, file:///etc shows me full directory list. firejail ls /etc or firejail links file:///etc works ok, though. blacklists are working fine.

cat /etc/firejail/generic.profile

Generic GUI application profile

include /etc/firejail/disable-mgmt.inc
include /etc/firejail/disable-secret.inc
include /etc/firejail/disable-common.inc
blacklist ${HOME}/.pki/nssdb
blacklist ${HOME}/.lastpass
blacklist ${HOME}/.keepassx
blacklist ${HOME}/.password-store
caps.drop all
seccomp
protocol unix,inet,inet6
netfilter
noroot
shell none
nogroups
private-etc resolv.conf,ca-certificates,ld.so.cache,ls.so.conf,mime.types

include /etc/firejail/disable-devel.inc

I can print included configurations, if needed (they are totally default)

I am curious, how that possibly happen?
Thanks

Originally created by @nntb2a on GitHub (Feb 27, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/329 Hello i have firejail version 0.9.38 and Dillo version 3.1-dev in gentoo system, both compiled by clang-3.5.0-r100 with all default configuration i have private-etc ignored by last version of dillo, file:///etc shows me full directory list. firejail ls /etc or firejail links file:///etc works ok, though. blacklists are working fine. cat /etc/firejail/generic.profile ###### # Generic GUI application profile ###### include /etc/firejail/disable-mgmt.inc include /etc/firejail/disable-secret.inc include /etc/firejail/disable-common.inc blacklist ${HOME}/.pki/nssdb blacklist ${HOME}/.lastpass blacklist ${HOME}/.keepassx blacklist ${HOME}/.password-store caps.drop all seccomp protocol unix,inet,inet6 netfilter noroot shell none nogroups private-etc resolv.conf,ca-certificates,ld.so.cache,ls.so.conf,mime.types include /etc/firejail/disable-devel.inc I can print included configurations, if needed (they are totally default) I am curious, how that possibly happen? Thanks
gitea-mirror 2026-05-05 05:21:59 -06:00
  • closed this issue
  • added the
    bug
    label
Author
Owner

@chiraag-nataraj commented on GitHub (Feb 27, 2016):

Huh...that's really odd. That doesn't happen on my computer. I'm using Debian sid, Firejail 0.9.38, and Dillo 3.0.5. Note: I'm sure this is correct in the config file, but ls.so.conf should probably be ld.so.conf? (It should just be ignored, though, so it shouldn't disable the whole filter).

<!-- gh-comment-id:189666638 --> @chiraag-nataraj commented on GitHub (Feb 27, 2016): Huh...that's really odd. That doesn't happen on my computer. I'm using Debian sid, Firejail 0.9.38, and Dillo 3.0.5. Note: I'm sure this is correct in the config file, but ls.so.conf should probably be ld.so.conf? (It should just be ignored, though, so it shouldn't disable the whole filter).
Author
Owner

@netblue30 commented on GitHub (Feb 27, 2016):

I've been able to reproduce it here on Debian 8. It looks like dillo talks to a daemon and gets the information over some soket. Thanks for the bug!

<!-- gh-comment-id:189667503 --> @netblue30 commented on GitHub (Feb 27, 2016): I've been able to reproduce it here on Debian 8. It looks like dillo talks to a daemon and gets the information over some soket. Thanks for the bug!
Author
Owner

@l29ah commented on GitHub (Feb 27, 2016):

On Sat, Feb 27, 2016 at 07:30:40AM -0800, chiraag-nataraj wrote:

Huh...that's really odd. That doesn't happen on my computer. I'm using Debian 8, Firejail 0.9.38, and Dillo 3.0.5. Note: I'm sure this is correct in the config file, but ls.so.conf should probably be ld.so.conf? (It should just be ignored, though, so it shouldn't disable the whole filter).

Failed to reproduce it on 3.0.5, but succeeded with dillo master.

() ascii ribbon campaign - against html mail
/\ http://arc.pasp.de/ - against proprietary attachments

<!-- gh-comment-id:189675939 --> @l29ah commented on GitHub (Feb 27, 2016): On Sat, Feb 27, 2016 at 07:30:40AM -0800, chiraag-nataraj wrote: > Huh...that's really odd. That doesn't happen on my computer. I'm using Debian 8, Firejail 0.9.38, and Dillo 3.0.5. Note: I'm sure this is correct in the config file, but ls.so.conf should probably be ld.so.conf? (It should just be ignored, though, so it shouldn't disable the whole filter). Failed to reproduce it on 3.0.5, but succeeded with dillo master. ## () ascii ribbon campaign - against html mail /\ http://arc.pasp.de/ - against proprietary attachments
Author
Owner

@nntb2a commented on GitHub (Feb 27, 2016):

reproduced on Dillo version 3.0.5
after file listing by dillo i have /usr/lib64/dillo/dpi/file/file.dpi process with this version too.

<!-- gh-comment-id:189689788 --> @nntb2a commented on GitHub (Feb 27, 2016): reproduced on Dillo version 3.0.5 after file listing by dillo i have /usr/lib64/dillo/dpi/file/file.dpi process with this version too.
Author
Owner

@nntb2a commented on GitHub (Apr 1, 2016):

any success?

<!-- gh-comment-id:204243137 --> @nntb2a commented on GitHub (Apr 1, 2016): any success?
Author
Owner

@netblue30 commented on GitHub (Apr 1, 2016):

I'll try to take a look shortly.

<!-- gh-comment-id:204364423 --> @netblue30 commented on GitHub (Apr 1, 2016): I'll try to take a look shortly.
Author
Owner

@netblue30 commented on GitHub (Apr 1, 2016):

It is similar to the Firefox problem, with a process running outside the sandbox. I don't think it can be exploited. I added a fix, so the process always runs in the sandbox. I also introduced a whitelisted profile for Dillo.

When you do private-etc, you also need to add /etc/dillo directory - they keep there some configurations files. Thanks for the bug.

<!-- gh-comment-id:204437565 --> @netblue30 commented on GitHub (Apr 1, 2016): It is similar to the Firefox problem, with a process running outside the sandbox. I don't think it can be exploited. I added a fix, so the process always runs in the sandbox. I also introduced a whitelisted profile for Dillo. When you do private-etc, you also need to add /etc/dillo directory - they keep there some configurations files. Thanks for the bug.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#229
No description provided.