mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3741] Error: failed to run /run/firejail/lib/fcopy #2360
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2360
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @reinerh on GitHub (Nov 11, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3741
A user reported issues with starting transmission-cli with firejail, and I'm able to reproduce it.
I also see the same error a couple of times with different profiles when running the test-profiles part of the test suite.
@reinerh commented on GitHub (Nov 11, 2020):
Seems to be related to a combination of private-bin and private-etc.
When commenting out either of them, the process is starting.
@reinerh commented on GitHub (Nov 11, 2020):
Commenting out private-lib in transmission-common.profile also helps.
@bbhtt commented on GitHub (Nov 12, 2020):
Yea I observed the same on Sid. I suggest to comment out
private-libintransmission-common.profilesince it works fine on Arch without any modification.@reinerh commented on GitHub (Nov 12, 2020):
That would workaround it for transmission only. But the same issue happens for other profiles as well.
@rusty-snake commented on GitHub (Nov 12, 2020):
I've
private-lib libpcre2-8.so.0in less.local and whois.local. Actually we should always add it toprivate-libvia it's implementation.@reinerh commented on GitHub (Nov 12, 2020):
libpcre2-8.so.0seems to come via the linking tolibselinux.so.1.maybe
libpcre2-8.so.needs to be added tosrc/firejail/fs_lib2.c?@bbhtt commented on GitHub (Nov 12, 2020):
Ah, ok I wasn't aware of that.
On November 12, 2020 8:54:06 AM UTC, Reiner Herrmann notifications@github.com wrote:
@reinerh commented on GitHub (Jan 29, 2021):
@smitsohu This issue seems to be back.
I upgraded to 0.9.64.2 and now have this problem again:
Could it be related to the change in
1e3891e?It looks like you replaced
fslib_install_list(PATH_FCOPY);withfslib_install_list(PATH_FIREJAIL);, so the libs needed by fcopy are no longer copied.@smitsohu commented on GitHub (Jan 30, 2021):
Mmmh, in the moment I have problems reproducing the issue on Bullseye.
fslib_install_list(PATH_FIREJAIL)doesn't work as a replacement, becauseprivate-binregularly removes firejail from the sandbox.Instead I went with your other idea
af2375300c/src/firejail/fs_lib2.c (L42)@reinerh commented on GitHub (Jan 30, 2021):
Here is a debug log:
While it is
Installing standard C library, it does not copy libpcre2 for some reason.@reinerh commented on GitHub (Jan 30, 2021):
static LibList libc_listinfs_lib2.cseems to be unused for copying files.It is only used for finding the name of the libc.
@smitsohu commented on GitHub (Jan 31, 2021):
@reinerh If you find the time, could you try if adding back
fslib_install_list(PATH_FCOPY)fixes this?Maybe we could run fldd as root on our helper binaries? After all we have to trust them anyway.
@reinerh commented on GitHub (Jan 31, 2021):
@smitsohu I tried it, but it didn't help:
@smitsohu commented on GitHub (Jan 31, 2021):
And if you relax permissions on
/usr/lib/x86_64-linux-gnu/firejail/fcopytorwxr-xr-x?@reinerh commented on GitHub (Jan 31, 2021):
@smitsohu With
fslib_install_list(PATH_FCOPY)ANDchmod 755 /usr/lib/*/firejail/fcopyit is working.@smitsohu commented on GitHub (Jan 31, 2021):
Just trying to understand what is going on: Is it possible you have libpcre2 in a place unexpected to firejail?
(what does
/usr/lib/x86_64-linux-gnu/firejail/fldd /usr/lib/x86_64-linux-gnu/firejail/fcopy | grep libpcre2say?)@reinerh commented on GitHub (Jan 31, 2021):
@smitsohu commented on GitHub (Jan 31, 2021):
Quite interesting. I have really no idea atm why
fslib_install_stdcdoesn't pick it up.I'll try to put together a pull request to run this stuff as root. Then we have read permission on fcopy and it should work again.
@smitsohu commented on GitHub (Feb 17, 2021):
@reinerh Do we have any time pressure here (= do you need this for one of your builds)? Just asking.
@reinerh commented on GitHub (Feb 17, 2021):
@smitsohu I don't think there is much pressure. If you can't reproduce it, it's maybe not so widespread and only occurs on certain systems.
It would be nice if it could be fixed by 1st of March, as I could then still apply a patch to the version packaged in Debian, and it would make it into the next stable (though fixing it later is probably also still possible if the change is not intrusive and we can argue it's important enough to fix).
If you want me to test or debug anything, please tell me.
@smitsohu commented on GitHub (Feb 17, 2021):
Ok. I'll try to have something by the weekend.