mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3796] firefox: YubiKey WebAuthn does not work #2396
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2396
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @OrfeasLitos on GitHub (Dec 7, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3796
Write clear, concise and in textual form.
Bug and expected behavior
Firefox has no access to the YubiKey
Firefox should accept input from and send output to the YubiKey
No profile and disabling firejail
firejail --noprofile /path/to/programin a terminal?No change
which <program>orfirejail --listwhile the sandbox is running)?No change
Reproduce
Steps to reproduce the behavior:
firejail firefox-developer-editionEnvironment
lsb_release -a,screenfetchorcat /etc/os-release)Arch Linux, x86_64 Linux 5.9.11-arch2-1
firejail --version) exclusive or used git commit (git rev-parse HEAD)firejail version 0.9.64
Additional context
I've tried
ignore private-devas per #1381 to no availChecklist
https://github.com/netblue30/firejail/issues/1139)probably not applicable
--profile=PROFILENAMEis used to set the right profile.LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAMto get english error-messages.debug output
@SkewedZeppelin commented on GitHub (Dec 7, 2020):
You need to:
sudo sed -i 's/# browser-disable-u2f yes/browser-disable-u2f no/' /etc/firejail/firejail.config;
@rusty-snake commented on GitHub (Dec 8, 2020):
Should be answered.
@OrfeasLitos commented on GitHub (Dec 8, 2020):
This solution didn't work for me. (I also tried restarting my machine after the change). Note that I want to use WebAuthn, not u2f. Can you please open this issue again?
@rusty-snake commented on GitHub (Dec 8, 2020):
nou2f/browser-disable-u2frefers to the hardware (e.g. YubiKey) and not the protocol (e.g. u2f, FIDO, FIDO2, ...)It happens w/o firejail. Then it's not a firejail issue in 99% of the cases.
@OrfeasLitos commented on GitHub (Dec 8, 2020):
I've tried the following steps and the YubiKey worked fine:
sudo firecfg --cleanrebootIt stopped working again when I did
sudo firecfgand rebooted. So it looks like a firejail issue.@OrfeasLitos commented on GitHub (Dec 8, 2020):
Now that I try it again, I guess that
firejail --noprofile /usr/local/bin/firefox-developer-editiondid not do the intended thing (disable the sandbox), as it gave me the following warning:It looks like it used the existing sandbox instead of turning it off.
EDIT: It definitely uses the sandbox, as Firefox doesn't have access to the filesystem.
@rusty-snake commented on GitHub (Dec 8, 2020):
Where was said that
--noprofiledisables the sandbox? It runs w/o profile.I guess that's the path to firejail (via symlink) and not to firefox? If you use
firejail --noprofile /usr/bin/firefox-developer-edition, the message should be gone.It should have access to the filesystem when using --noprofile (expections /proc, /sys, ~/.config/firejail).
Which sandboxes are running/started when you test this? (use
sudo firemon)@OrfeasLitos commented on GitHub (Dec 8, 2020):
That's correct, with
firejail --noprofile /usr/bin/firefox-developer-editionthe warning is gone. And/usr/local/bin/firefox-developer-editionis a symlink to firejail:Unfortunately no filesystem access with
firejail --noprofile /usr/bin/firefox-developer-edition. And/usr/bin/firefox-developer-editionis not a symlink to firejail:I have no
firefox.localconfiguration in~/.config/firejailif that's relevant.before sudo firecfg --clean
After running
sudo firecfg --clean, nothing new was printed bysudo firemon.After rebooting, I started
firemonand then didsudo firecfg. Stillfiremonprints nothing.I then started firefox (with a simple firefox-developer-edition) and got this from firemon
Hope this helps.
EDIT by @rusty-snake: fix markdown inside html (requires blank lines)
@OrfeasLitos commented on GitHub (Dec 18, 2020):
Was the issue reproducible at your end? Any other information that could help?
@rusty-snake commented on GitHub (Dec 18, 2020):
I've no u2f HW, so I can only speculate. And if
--noprofileruns with filesystem restrictions in $HOME, then there's something completely wrong. Because there are no other sandboxes involved, I'm out of ideas.What's in it?
@OrfeasLitos commented on GitHub (Dec 18, 2020):
That's a list of internet radio stations :) But I guess this isn't relevant.
@OrfeasLitos commented on GitHub (Dec 18, 2020):
One more thing that may be of interest is that I have installed firejail-handler-http.
@ghost commented on GitHub (Dec 18, 2020):
I don't think firejail-handler-http interferes with anything related to U2F, at least it shouldn't. Perhaps you can disable it temporarily while focussing/testing/debugging the U2F issue. On a side-note, I noticed you mention using firefox-developer-edition here in this thread. It might be a good idea to check your firejail-handler-settings-http.inc and ensure it points to /usr/bin/firefox-developer-edition instead of the default /usr/bin/firefox.
@OrfeasLitos commented on GitHub (Jan 23, 2021):
Closing because the problem went away. Thanks!