mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #329] security breach? #229
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#229
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @nntb2a on GitHub (Feb 27, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/329
Hello
i have firejail version 0.9.38 and Dillo version 3.1-dev in gentoo system, both compiled by clang-3.5.0-r100
with all default configuration i have private-etc ignored by last version of dillo, file:///etc shows me full directory list. firejail ls /etc or firejail links file:///etc works ok, though. blacklists are working fine.
cat /etc/firejail/generic.profile
Generic GUI application profile
include /etc/firejail/disable-mgmt.inc
include /etc/firejail/disable-secret.inc
include /etc/firejail/disable-common.inc
blacklist ${HOME}/.pki/nssdb
blacklist ${HOME}/.lastpass
blacklist ${HOME}/.keepassx
blacklist ${HOME}/.password-store
caps.drop all
seccomp
protocol unix,inet,inet6
netfilter
noroot
shell none
nogroups
private-etc resolv.conf,ca-certificates,ld.so.cache,ls.so.conf,mime.types
include /etc/firejail/disable-devel.inc
I can print included configurations, if needed (they are totally default)
I am curious, how that possibly happen?
Thanks
@chiraag-nataraj commented on GitHub (Feb 27, 2016):
Huh...that's really odd. That doesn't happen on my computer. I'm using Debian sid, Firejail 0.9.38, and Dillo 3.0.5. Note: I'm sure this is correct in the config file, but ls.so.conf should probably be ld.so.conf? (It should just be ignored, though, so it shouldn't disable the whole filter).
@netblue30 commented on GitHub (Feb 27, 2016):
I've been able to reproduce it here on Debian 8. It looks like dillo talks to a daemon and gets the information over some soket. Thanks for the bug!
@l29ah commented on GitHub (Feb 27, 2016):
On Sat, Feb 27, 2016 at 07:30:40AM -0800, chiraag-nataraj wrote:
Failed to reproduce it on 3.0.5, but succeeded with dillo master.
() ascii ribbon campaign - against html mail
/\ http://arc.pasp.de/ - against proprietary attachments
@nntb2a commented on GitHub (Feb 27, 2016):
reproduced on Dillo version 3.0.5
after file listing by dillo i have /usr/lib64/dillo/dpi/file/file.dpi process with this version too.
@nntb2a commented on GitHub (Apr 1, 2016):
any success?
@netblue30 commented on GitHub (Apr 1, 2016):
I'll try to take a look shortly.
@netblue30 commented on GitHub (Apr 1, 2016):
It is similar to the Firefox problem, with a process running outside the sandbox. I don't think it can be exploited. I added a fix, so the process always runs in the sandbox. I also introduced a whitelisted profile for Dillo.
When you do private-etc, you also need to add /etc/dillo directory - they keep there some configurations files. Thanks for the bug.