mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4013] nixnote2: Could not create AF_NETLINK socket #2503
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2503
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Rosika2 on GitHub (Feb 26, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4013
ENVIRONMENT:
Hi altogether,
I have a question as far as terminal output (when running firejail) is concerned:
Whenever I run the command
firejail nixnote2the programme works alright and is sandboxed without any difficulties.Yet taking a look at the terminal output I realized that as long as nixnote2 is running I get repeated entries of
"Could not create AF_NETLINK socket".
This message gets written to the terminal incessantly (4 entries in about 10 secs) until I quit the programme.
Any idea what´s going on?
Thanks a lot in advance.
Many greetings.
Rosika
P.S.:
Running
firejail --noprofile nixnote2doesn´t produce those logs!example output:
@rusty-snake commented on GitHub (Feb 26, 2021):
Fix: Allow nixnote2 to create AF_NETLINK sockets by adding
netlinkto the protocol set (--protocol=unix,inet,inet6,netlink).You should update, this version is vulnerable to CVE-2021-26910. See https://github.com/netblue30/firejail/issues/3996#issuecomment-780910781 and https://github.com/netblue30/firejail/issues/3968#issuecomment-777167840 and https://github.com/netblue30/firejail/issues/4006#issuecomment-785140992 and https://github.com/netblue30/firejail/issues/3982#issuecomment-778480897 and [I could not find this one]. Or you set
overlayfs noin/etc/firejail/firejail.configas workaround.nixnote2 doesn't have a profile yet. Request one in #1139 or write it yourself.
@Rosika2 commented on GitHub (Feb 26, 2021):
@rusty-snake:
Hi and thank you so much for your quick reply and help.
First of all: I updated firejail to version 0.9.64.4.
I have to admit I hadn´t added the respective ppa after having done a fresh install of Lubuntu a month ago.
That I did now and got the latest version. Great.
Thanks also for the links referring to the vulnerability.
As for my original problem:
firejail --protocol=unix,inet,inet6,netlink nixnote2works just fine. Thank you for pointing that out.I myself probably wouldn´t have considered that. Sorry.
This command is well suited for me as I use fish as my default shell and this makes getting hold of specific entries from history a piece of cake.
I just have to enter "nixnote2" ("nixn" would be sufficient as well) and then "ARROW UP" and I have the respective command.
Thank you again so much for your help. It´s greatly appreciated.
Many greetings and keep safe.
Rosika
@rusty-snake commented on GitHub (Feb 26, 2021):
FYI: You can also create a profile for it with this
protocolset.~/.config/firejail/nixnote2.profile:Or you start writing a profile for it.
profile.tempalte with `protocol unix,inet,inet6,netlink` and the commands from default.profile
@Rosika2 commented on GitHub (Feb 26, 2021):
@rusty-snake:
Hi again,
thank you for pointing out the two methods of achieving the goal. That´s certainly the professional way of doing it. :)
BTW:
Using thunar as my default file-manager I take advantage of the possibility of creating user-defined actions (from right-click-menu).
To this end I downloaded firewarden (quite a while ago now) and created entries like this one (example):
lxterminal --command="/media/rosika/f14a27c2-0b49-4607-94ea-2e56bbf76fe1/DATEN-PARTITION/Dokumente/Ergänzungen_zu_Programmen/zu_firewarden_focal/firewarden lximage-qt %f"This example should demonstrate how I use firejail (with the help of firewarden) to safely display pictures with lximage-qt.
I noticed this one created the same "AF_NETLINK socket" messages.
To verify this issue I ran "firejail lximage-qt" in a terminal and it produced those messages as well. Despite the fact that there´s a lximage-qt.profile available.
I looked at the contents of the profile and found out there´s an entry
protocol unix.So wouldn´t it be best to replace it by
protocol unix,inet,inet6,netlink?Thanks again for your help.
Many greetings.
Rosika
@rusty-snake commented on GitHub (Feb 26, 2021):
First of all: Here it would be
protocol unix,netlinkbecause lximage-qt does not need internet access (it hasnet none).Netlink adds some more permissions (but IDK exactly for what it can be used), so it's always better to not add it as long as nothing is broken. But how do you know that nothing is? If the program complains about it, it misses something it wants.
@kris7t commented on GitHub (Feb 26, 2021):
Please do note that
AF_NETLINKis generic communication interface for the kernel, and as such, allowing it potentially exposes a huge kernel API surface. Of course, most of these APIs are only for privileged processes, but there sill might be an opportunity for a sandbox escape (or exploitation of a kernel bug). So it'd certainly be a lot safer if nixnote could be fixed to be a good citizen and not to require such APIs.(There's also a case for using something like eBPF to filter AF_NETLINK traffic in firejail, but I'd guess that it'd be a monstrous task to implement.)
@Rosika2 commented on GitHub (Feb 27, 2021):
Hi all and thanks a lot for your replies.
@rusty-snake:
Good point. Well, the message I get is
Could not create AF_NETLINK socket (Vorgang wird nicht unterstützt).So basically it says: "Operation is not supported".
@kris7t:
I see. Well, perhaps it´s better not to allow it.
The thing is: Those repeated "Could not create AF_NETLINK socket"-messages don´t really bother me much.
I just wanted to what they were all about. So thanks for the information.
It´s only when I run the command
firejail lximage-qtfrom the terminal that I even noticed it. Were I to run the same command from the "enter-command-field" ("WIN-key+R" in Lubuntu 20.04) I wouldn´t have been aware of that in the first place.Would there be any argument aginst ignoring those messages and just running e.g.
firejail lximage-qtanyway?I mean: After closing the terminal nothing serious would´ve happened, would it?
Thanks for your opinions on the matter.
Greetings.
Rosika
@kris7t commented on GitHub (Feb 27, 2021):
The worst thing that could happen is that the application doesn't expect that AF_NETLINK is disabled and crashes.
Although I guess application functionality might be limited in some way... Netlink is usually used for stuff like modifying routing tables, accessing the kernel audit log, etc. that "normal" application shouldn't be doing, anyways, so I'd be suprised if any functionality would be broken (my best guess is that some library is trying to use Netlink to detect whenever the internet connection is lost and try to reconnect or something like that). Technically, you can use Netlink as a generic IPC interface between user-space applications, but D-Bus is much more popular for that (and is used by Qt by default and can be filtered by firejail).
@Rosika2 commented on GitHub (Feb 27, 2021):
@kris7t:
Thanks for the information.
Well, nothing has crashed. It´s just those terminal-messages that I hadn´t been able to interpret.
I even had
dmesg -wrunning at the same time but no output (referring to this topic) there either.So I hope it´s o.k. then.
BTW: adding --noprofile to the firejail command eliminates those messages. I guess that´s to be expected.
Thank you again for explaining the matter in such detail. I always like to learn something new.
Many greetings.
Rosika