github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3792] MTP Android files can be copied outside firejail in Thunar file manager. #2392

New issue

Closed

opened 2026-05-05 09:04:15 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:04:15 -06:00

Owner

Originally created by @query321 on GitHub (Dec 7, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3792

Hello, I'm not sure if this could be categorized as a security issue.

First I start a bash session with the following parameters;

firejail --seccomp --nonewprivs --caps.drop=all --disable-mnt --hostname=test --blacklist=/sbin --blacklist=/usr/sbin --noexec=/var --noexec=/mnt --noexec=/usr/local/bin/ffmpeg --noexec=/media --noexec=/mnt --noexec=/usr/bin/python* --noexec=/usr/bin/pip3 --noexec=/usr/lib/python* --noexec=/opt --x11=xorg --private-cache --noroot --no3d --noexec=/bin/system* --noexec=/usr/bin/su* --noexec=/usr/bin/git --private

Then, I type in thunar from the sandboxed shell to open sandboxed thunar file manager. Then I connect my Android phone using a usb cable, then mount the phone from thunar file manager side navigation bar, and then try copy a file from my phone to the home directory of the sandboxed firejail home directory. Nothing is copied to sandboxed home directory of the firejailed home directory, instead if I open a non firejailed terminal shell session and ls my real home directory, it shows that the file was copied to the real home directory instead of the sandboxed one, even though I ran thunar from within the sandboxed environment.

Then I tried copying different files from my phone to /tmp directory, then copying back to sandboxed home directory from within firejail enviroment. This time the files didn't copy itself outside the sandboxed home to real home directory.

Info

I am running as a non-root user(a regular user, not in sudoers group), using Debian buster 10.7, with i3 window manager.

Some more info

[user@debian]:~$ cat /etc/debian_version
10.7

[user@debian]:~$ uname -a
Linux debian 4.19.0-13-686 #1 SMP Debian 4.19.160-2 (2020-11-28) i686 GNU/Linux

[user@debian]:~$ lsb_release -a
Description: Debian GNU/Linux 10 (buster)
Release: 10
Codename: buster

[user@debian]:~$ firejail --version
firejail version 0.9.58.2

Compile time support:
- AppArmor support is enabled
- AppImage support is enabled
- chroot support is enabled
- file and directory whitelisting support is enabled
- file transfer support is enabled
- networking support is enabled
- overlayfs support is enabled
- private-home support is enabled
- seccomp-bpf support is enabled
- user namespace support is enabled
- X11 sandboxing support is enabled

I also did apparmor_parser -r /etc/apparmor.d/firejail-default after installation and have apparmor-profiles and apparmor-utils installed, and aa-enabled returns Yes. Aside from that, I haven't tinkered with the profiles. All of the profiles are at their default state.

Originally created by @query321 on GitHub (Dec 7, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3792 Hello, I'm not sure if this could be categorized as a security issue. First I start a bash session with the following parameters; `firejail --seccomp --nonewprivs --caps.drop=all --disable-mnt --hostname=test --blacklist=/sbin --blacklist=/usr/sbin --noexec=/var --noexec=/mnt --noexec=/usr/local/bin/ffmpeg --noexec=/media --noexec=/mnt --noexec=/usr/bin/python* --noexec=/usr/bin/pip3 --noexec=/usr/lib/python* --noexec=/opt --x11=xorg --private-cache --noroot --no3d --noexec=/bin/system* --noexec=/usr/bin/su* --noexec=/usr/bin/git --private` Then, I type in `thunar` from the sandboxed shell to open sandboxed thunar file manager. Then I connect my Android phone using a usb cable, then mount the phone from thunar file manager side navigation bar, and then try copy a file from my phone to the home directory of the sandboxed firejail home directory. Nothing is copied to sandboxed home directory of the firejailed home directory, instead if I open a non firejailed terminal shell session and `ls` my real home directory, it shows that the file was copied to the real home directory instead of the sandboxed one, even though I ran thunar from within the sandboxed environment. Then I tried copying different files from my phone to `/tmp` directory, then copying back to sandboxed home directory from within firejail enviroment. This time the files didn't copy itself outside the sandboxed home to real home directory. **Info** I am running as a non-root user(a regular user, not in sudoers group), using Debian buster 10.7, with i3 window manager. **Some more info** `[user@debian]:~$ cat /etc/debian_version` `10.7` `[user@debian]:~$ uname -a` `Linux debian 4.19.0-13-686 #1 SMP Debian 4.19.160-2 (2020-11-28) i686 GNU/Linux` `[user@debian]:~$ lsb_release -a` `Description: Debian GNU/Linux 10 (buster)` `Release: 10` `Codename: buster` `[user@debian]:~$ firejail --version` `firejail version 0.9.58.2` `Compile time support:` ` - AppArmor support is enabled` ` - AppImage support is enabled` ` - chroot support is enabled` `- file and directory whitelisting support is enabled` `- file transfer support is enabled` `- networking support is enabled` `- overlayfs support is enabled` `- private-home support is enabled` `- seccomp-bpf support is enabled` `- user namespace support is enabled` `- X11 sandboxing support is enabled` I also did `apparmor_parser -r /etc/apparmor.d/firejail-default` after installation and have apparmor-profiles and apparmor-utils installed, and aa-enabled returns `Yes`. Aside from that, I haven't tinkered with the profiles. All of the profiles are at their default state.

gitea-mirror closed this issue

2026-05-05 09:04:16 -06:00

gitea-mirror commented

2026-05-05 09:04:18 -06:00

Author

Owner

@rusty-snake commented on GitHub (Dec 7, 2020):

I guess MTP is implemented via GVFS. Or in general: GIO uses GVFS for everything except file:///.

If you add ~~--dbus-user=none~~ --nodbus [EDIT: firejail 0.9.58.2], this should be no longer possible. (And you can no longer access your phone via MTP from inside the sandbox).

@rusty-snake commented on GitHub (Dec 7, 2020): I guess MTP is implemented via GVFS. Or in general: GIO uses GVFS for everything except `file:///`. If you add ~`--dbus-user=none`~ `--nodbus` [EDIT: firejail 0.9.58.2], this should be no longer possible. (And you can no longer access your phone via MTP from inside the sandbox).

gitea-mirror commented

2026-05-05 09:04:19 -06:00

Author

Owner

@query321 commented on GitHub (Dec 18, 2020):

Yes indeed, mtp was implemented with gvfs.

@query321 commented on GitHub (Dec 18, 2020): Yes indeed, mtp was implemented with gvfs.

gitea-mirror commented

2026-05-05 09:04:20 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 4, 2021):

I think we can close, dbus access is restricted where possible.

@rusty-snake commented on GitHub (Jan 4, 2021): I think we can close, dbus access is restricted where possible.

gitea-mirror referenced this issue

2026-05-05 10:17:17 -06:00

[PR #2392] [MERGED] Add netlink to QMediathekView #4288

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2392

No description provided.

Rows
Columns