mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3855] "caps.drop all" fails to run commands which have capabilities set (was: node does not want to run (but the same binary renamed works)) #2427
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2427
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @haraldkubota on GitHub (Dec 30, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3855
Bug and expected behavior
Describe the bug.
I tried to test firejail with a sample Node.js test program. Dart worked fine. However node does not get executed at all. When renaming the node binary to node2, it works as expected.
What did you expect to happen?
I expected that node (the binary) gets executes since it's not excluded via disabled-interpreters.inc
No profile and disabling firejail
firejail --noprofile /path/to/programin a terminal?It works using node. Works also with node2.
which <program>orfirejail --listwhile the sandbox is running)?I can use absolute, relative or no path and it makes no difference.
firejail --list is not helpful since the executable does not get executed.
Reproduce
Steps to reproduce the behavior:
node is in ~/js/node/bin/node and node2 is a copy of node in the same directory. PATH includes this dir.
Environment
Additional context
For test I renamed /etc/firejail/disable-interpreters.inc (the only place which listed node as something to blacklist)
debug output
@reinerh commented on GitHub (Dec 30, 2020):
Is
/home/harald/js/node/bin/nodethe node binary, or a wrapper script?@haraldkubota commented on GitHub (Dec 31, 2020):
It's the node binary (and node2 is a copy of it):
Digging a bit, I got the line which causes node to fail: when I comment out "#caps.drop all" in /etc/firejail/default.profile, then node works. node2 works too.
When I leave "caps.drop all" which is the sensible default, node fails and node2 still works.
That's (for me) hard to explain since it's not specific to the node binary.
Tested on ARM64 and x86_64: same behavior: "caps.drop all" somehow acts differently on my 2 seemingly identical binaries.
@haraldkubota commented on GitHub (Dec 31, 2020):
Update: Also tried the latest release (master from the github repo): compiled with apparmor and selinux support. Tried without apparmor and selinux too. In all cases: same behavior (x86_64 only, ARM64 not tested): "caps.drop all" makes node not work. node2 always works.
And another test: After commenting out "#caps.drop all" from /usr/local/etc/firejail/default.profile (self-compiled 0.9.65):
So the caps.drop is the problem.
Update: Seems the binary is the problem: When I do:
Now it works. So it's not the name "node", but something else which is part of the node binary which does not get copied over when creating a copy of it.
And it might be this:
which gets lost when doing a copy. And indeed, when I set this capability to the node2 binary, it stops working once I include the "--caps.drop=all" option.
Is that expected behavior? It's not what I expect. I expected "caps.drop all" to drop all capabilities and not not-executing the program in question.
@reinerh commented on GitHub (Dec 31, 2020):
Ah ok, your node binary has capabilities set, which were not preserved when you copied it (as you already assumed).
But I'm not sure why firejail doesn't want to drop it. That might be a bug.
@haraldkubota commented on GitHub (Dec 31, 2020):
Not sure this helps or not:
When I do "--caps-keep=net_raw", then node executes.
node2, which has no capabilities, works:
I don't know (yet) enough about capabilities and what exactly disables execution of a binary with capabilities set. I only use firejail since 18h ago...
@rusty-snake commented on GitHub (Apr 6, 2021):
Any progress here?
@rusty-snake commented on GitHub (Jun 10, 2021):
I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.