mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3647] webkit2gtk-4.0 requires bwrap #2298
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2298
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @SkewedZeppelin on GitHub (Sep 27, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3647
The new webkit2gtk-4.0/-2.30 seems to hard require bubblewrap.
This causes firejailed programs such as evolution and epiphany fail to start.
The profiles will need to be updated ala chromium probably.
Edit:
#2995 dropped support for epiphany because of this
@reinerh commented on GitHub (Sep 27, 2020):
surf is another one using webkitgtk. though after a quick test it was still working in firejail.
@rusty-snake commented on GitHub (Sep 27, 2020):
FWIW: https://blogs.gnome.org/mcatanzaro/2020/03/31/sandboxing-webkitgtk-apps/
Fedoras kernel has unprivileged user-ns always enabled. The non-suid bwrap binary which is therefore used as default in Fedora works with these minimal changes:
However the suid variant will need more permissions, such as no nonewprivs.
UPDATE: https://github.com/netblue30/firejail/issues/3647#issuecomment-769288256
@ckotte commented on GitHub (Oct 8, 2020):
Just adding
noblacklist /usr/bin/bwrapworks with evolution 3.38 on Arch LinuxEdit: Sorry. I'm wrong.I can start evolution, but new emails cannot be read. I get
@rusty-snake How can I put those seccomp and dev-bind options into the profile?
@rusty-snake commented on GitHub (Oct 9, 2020):
--dev-bind / /is a bwrap option.However, from the error message you likely need to add
protocol unix,inet,inet6,netlink(addingnetlink) likewise.@ckotte commented on GitHub (Oct 9, 2020):
Now I get this
bwrap: Can't mount proc on /newroot/proc: Operation not permitted. Probably better to not use firejail with evolution anymore..@rusty-snake commented on GitHub (Oct 9, 2020):
Does Arch ship the suid variant? (check
ls -l /usr/bin/bwrap)Does it work with
--noprofile? If not we'll need to remove all those programs from firecfg (or make it work).@ckotte commented on GitHub (Oct 12, 2020):
No suid:
Doesn't work with
--noprofile. I always getbwrap: Can't mount proc on /newroot/proc: Operation not permitted@rusty-snake commented on GitHub (Oct 12, 2020):
Maybe it is caused by the pid-namespace. (If so) we need a option to run the sandbox in the default pid-namespace. Can you post the full bwrap cmd, maybe it only happens if a certain option is used.
Since the are flatpaks for almost every GNOME-App and bwrap does not work inside bwrap, there must be some code which disable the webkit2gtk-4.0 sandbox. Maybe we can trigger this or add a patch to trigger this by a env-var (or there is already one).
@ckotte commented on GitHub (Oct 12, 2020):
There are two bwrap processes
/usr/bin/bwrap --args 58 -- /usr/lib/WebKitWebProcess 7 48when running without firejail.I couldn't find a bwrap command in the evolution code. So, not sure how this works.
I also cannot find anything to configure flatpak/bwrap for evolution.
@rusty-snake commented on GitHub (Oct 13, 2020):
They pass is via FD 😢 . This bwrap call is in the webkit2gtk code and not in evolution, but I could not find a webkit2gtk repo in the internet.
If flatpak and flathub are configured:
flatpak install flathub org.gnome.Evolution@reinerh commented on GitHub (Oct 13, 2020):
https://sources.debian.org/src/webkit2gtk/2.30.1-1/Source/WebKit/UIProcess/Launcher/glib/ProcessLauncherGLib.cpp/?hl=203#L203
Looks like they check for flatpak and other sandboxing already.
@Micha-Btz commented on GitHub (Nov 21, 2020):
my evolution on debian sid doesn't work. After creating evolution.local with
evoluition starts, but I'm unable to read a mail, since
The output from the console shows:
I have tested also the newest profile from git hub since it seems to be newer then the debian one, also no success.
Any idea?
Micha
@Micha-Btz commented on GitHub (Nov 21, 2020):
Additional question, is firejail needed when bwrap is also a sandbox application?
@rusty-snake commented on GitHub (Nov 21, 2020):
ohh no not debian, this will be even harder. Debian has unprivileged-userns-clones disable and therefore bwrap installed as suid. Either you enable them (
sysctl kernel.unprivileged-userns-clone=1) and remove setuid bit from bwarp, or you make it work with firejail. For that you need to removenonewprivsand likely some more, also you need must not setforce-nonewprivs yesin /etc/firejail/firejail.config. But first check that it works with--nopofile(andforce-nonewprivs noin firejail.config).Firejail still provides extra security by sandboxing the full application and not parts of it. However, the internal-bwrap sandbox sandboxes the web-content-processes which have a major attack-surfface because they deal with untrusted input. IDK how tight this sandbox is, but those processes usually don't need any filesystem access, so I think they ok. So if you don't want dig deeper, you very likely well protected if you only use the bwrap sandbox for now.
@bbhtt commented on GitHub (Dec 7, 2020):
Can someone confirm if
WEBKIT_FORCE_SANDBOX=0 evolutionworks on Debian?@rusty-snake commented on GitHub (Jan 28, 2021):
Did a bit strace, here are my findings:
The error occurs only if bwrap is called with
--unshare-pidand--proc /proc. So the minimal STR isfirejail --noprofile bwrap --unshare-pid --proc /proc --dev-bind / / bash.@loveshack commented on GitHub (Aug 25, 2021):
It does, at least to the extent of reading a message, so I've set it in evolution.local.
I'm on Debian 11 with firejail 0.9.66 from the backports repo.
(Unlike on Debian 10, bwrap isn't suid.)
@pedrib commented on GitHub (Oct 1, 2021):
@loveshack can you share your working profile for Debian 11?
I'm not using bwrap (starting with
WEBKIT_FORCE_SANDBOX=0 evolutionbut the built-in firejail profile doesn't work for me with Evolution 3.38.3-1 / firejail 0.9.66:@amano-kenji commented on GitHub (Jul 7, 2022):
This makes bwrap work inside foliate firejail sandbox. bwrap requires
I haven't been able to figure out which binaries need to be passed to private-bin.
@amano-kenji commented on GitHub (Jul 7, 2022):
bwrap requires a lot of capabilities and lack of seccomp. This seems to outweigh benefits of running bwrap inside firejail sandbox.
bdf42ae2bf/source/renderer/gi-gtk.lisp (L30)nyxt browser just disables webkit sandbox.
7637414ed9/documents/README.org (run-nyxt-in-a-security-sandbox)nyxt recommends using an external sandbox like guix container or firejail.
@sak96 commented on GitHub (Aug 27, 2022):
is there a possibility of getting a feature to set environment variables in profiles ?
this could help manage issue easily.
cc: @rusty-snake
@reinerh commented on GitHub (Aug 27, 2022):
That is already possible:
@sak96 commented on GitHub (Aug 27, 2022):
does that mean this solved the problem for foliate ??
@reinerh commented on GitHub (Aug 27, 2022):
I don't know. If you have that problem, why don't you try it?
@sak96 commented on GitHub (Aug 27, 2022):
yeah tried it. It works. thanks.
i am just surprised that last time i check i did not fine
envinman firejail-profile.i think i overlooked it.
@sak96 commented on GitHub (Apr 28, 2023):
looks like the env variable is changed.
@amano-kenji commented on GitHub (May 13, 2023):
Should webkit sandbox be disabled? Or, should it be used in firejail?
@rusty-snake commented on GitHub (May 13, 2023):
You should NOT disable it.
@amano-kenji commented on GitHub (May 13, 2023):
I tried to put nyxt with webkit sandbox in firejail sandbox and got this error message.
@amano-kenji commented on GitHub (May 15, 2023):
After disabling apparmor, I get this error message.
I haven't figured out a way to run a bwrap sandbox inside firejail.
@amano-kenji commented on GitHub (Oct 11, 2023):
Has anyone found a way to make bwrap work inside firejail? How does firefox sandbox work inside firejail?
@ipaqmaster commented on GitHub (Dec 23, 2023):
Can't seem to get gnome-notes (
bijiben) to function with the default firejail enabled. It seems to throwFailed to start dbus proxy: Failed to spawn child process “/usr/bin/bwrap” (No such file or directory).@rusty-snake commented on GitHub (Dec 23, 2023):
Looks linke they updated to gtk-4.
@amano-kenji commented on GitHub (Jan 24, 2024):
At this point, I think it's better to just disable bwrap with
because I could not find a way to make bwrap work inside firejail sandbox. If I had to choose between the two, I would choose firejail because webkit sandbox doesn't place a tight access control over filesystem. The webkit sandbox isn't configurable, either. Firejail sandbox is configurable and tighter.
We can't drag this on for ever. We need something working in a timely manner. I can't wait 3 decades for this issue to be resolved...
@rusty-snake commented on GitHub (Jan 24, 2024):
DON'T DO THIS!
This is not true. The code can be found here.
Heavily depends on the profile.
@rusty-snake commented on GitHub (Jan 24, 2024):
https://github.com/netblue30/firejail/issues/3647#issuecomment-769288256
Doing this with crablock that uses new-mount-api, the
fsmountcall fails withEPERM.fsopenandfsconfig(includingCMD_CREATE) work.@rusty-snake commented on GitHub (Jan 24, 2024):
Actually we get a warning in dmesg. 🥳
@rusty-snake commented on GitHub (Jan 24, 2024):
What happens if we don't blacklist them?
@rusty-snake commented on GitHub (Jan 24, 2024):
diff
@rusty-snake commented on GitHub (Jan 24, 2024):
Relevant execution path you have to look at:
@rusty-snake commented on GitHub (Jan 24, 2024):
Btw, crablock mounts with
subset=pidby default, so mountingprocwould not reveal anything new. Anyway, I think it is ok to check this atfsmountbecause you couldfspickthe superblock later on and undo this I think.@amano-kenji commented on GitHub (Jan 25, 2024):
Look. I know webkit sandbox cannot be allowed to restrict access to user directories because restricting user access will cause people to ditch web browsers... That's a UX disaster..... Web browsers will be killed if they restricted user access by default.
People will just use another web browser that lets them upload files from any directory without a hassle....
If google chrome pulled off this stunt, it will lose market share to firefox very quickly... Google chrome will die in a month.
With firejail, users choose to restrict user access to a subset of it. With firejail, users have control. With webkit sandbox, users don't get to choose which directories are whitelisted or blacklisted.
I'm not comfortable with a web browser having access to my private files......
@amano-kenji commented on GitHub (Jan 25, 2024):
So, you found a way to make bwrap work inside firejail? Perhaps, can it be packaged as
allow-bwrap.incor something else?@rusty-snake commented on GitHub (Jan 25, 2024):
The webkit process does not have access to all your private files:
@rusty-snake commented on GitHub (Jan 25, 2024):
It requires code changes. But after that it should be possible with an
include allow-bwrap.inc.@amano-kenji commented on GitHub (Jan 25, 2024):
I didn't know that was going on. However, I still want to restrict browser access from my end through firejail or apparmor.
The bloated browser program itself still has user access...
@amano-kenji commented on GitHub (Nov 5, 2024):
Is this issue difficult to solve?
@rusty-snake commented on GitHub (Nov 5, 2024):
You have to check that allowing the paths in https://github.com/netblue30/firejail/issues/3647#issuecomment-1908744772 can not be abused (e.g. privilege escalation). Then you have to replace them with
profile_addand write anallow-bwrap.inc. The difficult part, debugging why it isn't working, is already done.@disposableone commented on GitHub (Feb 9, 2025):
I'm getting the same problem with Foliate ebook reader that's using bwrap for webkitgtk6.0. https://github.com/netblue30/firejail/issues/6644