mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4006] zoom: cannot save chat logs #2502
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2502
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @VorpalBlade on GitHub (Feb 24, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4006
Write clear, concise and in textual form.
Bug and expected behavior
Describe the bug.
Saving chat logs in zoom (from the "..." menu in the chat of a meeting doesn't work. Zoom lacks permission to save the file. The default (only?) location is ~/Documents/Zoom for this.
What did you expect to happen?
Zoom should be allowed access to save chat logs, sent files etc.
The fix is simple, add the following to zoom.local (or better yet, to the standard profile so other users can benefit from it):
No profile and disabling firejail
firejail --noprofile /path/to/programin a terminal?It works when using --noprofile.
which <program>orfirejail --listwhile the sandbox is running)?I don't understand this question.
Reproduce
Steps to reproduce the behavior:
firejail zoomEnvironment
lsb_release -a,screenfetchorcat /etc/os-release)firejail --version) exclusive or used git commit (git rev-parse HEAD)Installed from Ubuntu packages:
Additional context
Other context about the problem like related errors to understand the problem.
Checklist
https://github.com/netblue30/firejail/issues/1139)--profile=PROFILENAMEis used to set the right profile.Not an AppImage.
LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAMto get english error-messages.No error messages, so irrelevant.
browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.Not relevant for Zoom.
debug output
@VorpalBlade commented on GitHub (Feb 24, 2021):
Looking at it further,
${DOCUMENTS}should probably be used instead.@rusty-snake commented on GitHub (Feb 24, 2021):
The problem is that "Documents" can also be "Dokumente", "Dokumenty", "Dokumentuak", "文档", "Документы", ... so
whitelist ${DOCUMENTS}must be used instead [As you already discovered]. This has the drawback that${DOCUMENTS}/Zoomis treated literally, so zoom has full access to~/Documents./usr/bin/zoom(or where ever it is installed), but doesn't matter here. In general it does not matter if--noprofileworks.We should reword this, there more issues with don't/miss understand of this.
You should update, this version is vulnerable to CVE-2021-26910.
@VorpalBlade commented on GitHub (Feb 24, 2021):
Are you sure that Ubuntu hasn't backported a fix? If so, someone should probably tell them, as this is the version (0.9.62-3) in Ubuntu 20.04 which is LTS...
@rusty-snake commented on GitHub (Feb 24, 2021):
Go to the changelog of the ubu package: https://packages.ubuntu.com/focal/firejail -> https://changelogs.ubuntu.com/changelogs/pool/universe/f/firejail/firejail_0.9.62-3/changelog
and see
as latest change. Compare this to https://github.com/netblue30/firejail/releases/tag/0.9.64.4: 17. Feb 2021.
You simply test if
firejail --overlayfs-named=foobar --noprofile bashworks. If it works, you're vulnerable.https://seclists.org/oss-sec/2021/q1/121
@VorpalBlade commented on GitHub (Feb 24, 2021):
I filed a bug report with Ubuntu about this (https://bugs.launchpad.net/ubuntu/+source/firejail/+bug/1916767 but it is apparently private since I marked it as a security issue. Since the issue is disclosed that is silly but I don't see how to "unprivate" it)
@VorpalBlade commented on GitHub (Feb 24, 2021):
Oh and https://firejail.wordpress.com/download-2/cve-status/ should probably be updated to include this CVE. I don't see it on there.
@rusty-snake commented on GitHub (Feb 24, 2021):
Arch, Debian, Fedora, openSUSE had fixed (update/bakcport) this fast (<24h AFAICT) but Alpine, Manjaro, Ubuntu and therefore Mint are still shipping vulnerable versions. You see, if you want security the must important point is to choose the right distro.
@netblue30
@kmk3 commented on GitHub (Feb 25, 2021):
@VorpalBlade commented 14 hours ago:
@rusty-snake commented 14 hours ago:
For reference, this problem is related to #2359.