[GH-ISSUE #4017] new protocol list behaviour needs to be announced somewhere so users can adjust their local overrides #2504

New issue

Closed

opened 2026-05-05 09:11:19 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented 2026-05-05 09:11:19 -06:00

Owner

Copy link

Originally created by @ghost on GitHub (Feb 28, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4017

After one of the Sailfish commits a basic protocol override (in .local or via command-line) no longer works as expected. By this I mean the sandbox is no longer running with the intended protocol list, which was the behaviour prior to github.com/netblue30/firejail@5d88ee8957.

It would be nice if someone could try to reproduce this so - if it's indeed a regression - we can work with the Sailfish people to work things out. To this end I've made a tiny test-case using wget. The current wget.profile has protocol unix,inet,inet6. Using it with --protocol=unix (on the command-line) or protocol unix (in wget.local) should break it, as wget obviously needs internet access.

• without 5d88ee8957
  protocol works as expected

$ firejail --protocol=unix /usr/bin/wget https://github.com/netblue30/firejail/raw/master/README.md
--2021-02-26 17:24:29--  https://github.com/netblue30/firejail/raw/master/README.md
Resolving github.com (github.com)... failed: Temporary failure in name resolution.
wget: unable to resolve host address 'github.com'

• including 5d88ee8957
  protocol does NOT work as expected

$ firejail --debug --protocol=unix /usr/bin/wget https://github.com/netblue30/firejail/raw/master/README.md | tee fj.debug.log
--2021-02-26 17:24:29--  https://github.com/netblue30/firejail/raw/master/README.md
Resolving github.com (github.com)... 140.82.121.3
Connecting to github.com (github.com)|140.82.121.3|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://raw.githubusercontent.com/netblue30/firejail/master/README.md [following]
--2021-02-26 17:33:36--  https://raw.githubusercontent.com/netblue30/firejail/master/README.md
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.110.133, 185.199.111.133, 185.199.108.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.110.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 13626 (13K) [text/plain]
Saving to: 'README.md'

README.md               100%[===============================>]  13.31K  --.-KB/s    in 0.001s

2021-02-26 17:33:37 (9.11 MB/s) - 'README.md' saved [13626/13626]
$ grep " protocol" fj.debug.log
Build protocol filter: unix,inet,inet6
sbox run: /run/firejail/lib/fseccomp protocol build unix,inet,inet6 /run/firejail/mnt/seccomp/seccomp.protocol
Install protocol filter: unix,inet,inet6

According to this comment there is a new syntax for handling protocol lists:

/* Comma separated list is processed so that:
* "item" -> adds item to list
* "-item" -> removes item from list
* "+item" -> adds item to list
* "=item" -> clear list, add item
*
* For example:
* ,a,,,b,,,c, -> a,b,c
* a,,b,,,c,a -> a,b,c
* a,b,c,-a -> b,c
* a,b,c,-a,a -> b,c,a
* a,+b,c -> a,b,c
* a,b,=c,d -> c,d
* a,b,c,= ->
*/

I've tried these variations with mixed results. According to my observations only the --protocol=+ syntax seems to be working as advertised. I wonder if it is wise to revert the Sailfish commit until this is tested more extensively.

$ firejail --protocol +netlink /usr/bin/wget https://github.com/netblue30/firejail/raw/master/README.md
Error: invalid --protocol command line option

$ firejail --debug --protocol=+netlink /usr/bin/wget https://github.com/netblue30/firejail/raw/master/README.md| tee fj.debug.log
[...]
$ grep " protocol" fj.debug.log
Build protocol filter: netlink,unix,inet,inet6
sbox run: /run/firejail/lib/fseccomp protocol build netlink,unix,inet,inet6 /run/firejail/mnt/seccomp/seccomp.protocol
Install protocol filter: netlink,unix,inet,inet6

$ firejail --debug --protocol=-inet /usr/bin/wget https://github.com/netblue30/firejail/raw/master/README.md| tee fj.debug.log
[...]
$ grep " protocol" fj.debug.log
Build protocol filter: unix,inet,inet6
sbox run: /run/firejail/lib/fseccomp protocol build unix,inet,inet6 /run/firejail/mnt/seccomp/seccomp.protocol
Install protocol filter: unix,inet,inet6

$ firejail --debug --protocol=-inet6 /usr/bin/wget https://github.com/netblue30/firejail/raw/master/README.md| tee fj.debug.log
[...]
$ grep " protocol" fj.debug.log
Build protocol filter: unix,inet,inet6
sbox run: /run/firejail/lib/fseccomp protocol build unix,inet,inet6 /run/firejail/mnt/seccomp/seccomp.protocol
Install protocol filter: unix,inet,inet6

$ firejail --debug --protocol=netlink /usr/bin/wget https://github.com/netblue30/firejail/raw/master/README.md| tee fj.debug.log
[...]
$ grep " protocol" fj.debug.log
Build protocol filter: netlink,unix,inet,inet6
sbox run: /run/firejail/lib/fseccomp protocol build netlink,unix,inet,inet6 /run/firejail/mnt/seccomp/seccomp.protocol
Install protocol filter: netlink,unix,inet,inet6

Originally created by @ghost on GitHub (Feb 28, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4017 After one of the Sailfish commits a basic `protocol` override (in .local or via command-line) no longer works as expected. By this I mean the sandbox is no longer running with the _intended_ protocol list, which was the behaviour prior to https://github.com/netblue30/firejail/commit/5d88ee8957dc38a52c36f71b91c786dbec9d4ec9. It would be nice if someone could try to reproduce this so - if it's indeed a regression - we can work with the Sailfish people to work things out. To this end I've made a tiny test-case using wget. The current wget.profile has `protocol unix,inet,inet6`. Using it with `--protocol=unix` (on the command-line) or `protocol unix` (in wget.local) _should_ break it, as wget obviously needs internet access. - without 5d88ee8957dc38a52c36f71b91c786dbec9d4ec9 protocol works as expected ``` $ firejail --protocol=unix /usr/bin/wget https://github.com/netblue30/firejail/raw/master/README.md --2021-02-26 17:24:29-- https://github.com/netblue30/firejail/raw/master/README.md Resolving github.com (github.com)... failed: Temporary failure in name resolution. wget: unable to resolve host address 'github.com' ``` - including 5d88ee8957dc38a52c36f71b91c786dbec9d4ec9 protocol does NOT work as expected ``` $ firejail --debug --protocol=unix /usr/bin/wget https://github.com/netblue30/firejail/raw/master/README.md | tee fj.debug.log --2021-02-26 17:24:29-- https://github.com/netblue30/firejail/raw/master/README.md Resolving github.com (github.com)... 140.82.121.3 Connecting to github.com (github.com)|140.82.121.3|:443... connected. HTTP request sent, awaiting response... 302 Found Location: https://raw.githubusercontent.com/netblue30/firejail/master/README.md [following] --2021-02-26 17:33:36-- https://raw.githubusercontent.com/netblue30/firejail/master/README.md Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.110.133, 185.199.111.133, 185.199.108.133, ... Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.110.133|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 13626 (13K) [text/plain] Saving to: 'README.md' README.md 100%[===============================>] 13.31K --.-KB/s in 0.001s 2021-02-26 17:33:37 (9.11 MB/s) - 'README.md' saved [13626/13626] $ grep " protocol" fj.debug.log Build protocol filter: unix,inet,inet6 sbox run: /run/firejail/lib/fseccomp protocol build unix,inet,inet6 /run/firejail/mnt/seccomp/seccomp.protocol Install protocol filter: unix,inet,inet6 ``` According to [this comment]( https://github.com/netblue30/firejail/commit/5d88ee8957dc38a52c36f71b91c786dbec9d4ec9#diff-7c733ed074575806d2755a48dd858c22c318d0190737f64299fa6dda414ba29bR1801) there is a `new syntax` for handling protocol lists: /* Comma separated list is processed so that: * "item" -> adds item to list * "-item" -> removes item from list * "+item" -> adds item to list * "=item" -> clear list, add item * * For example: * ,a,,,b,,,c, -> a,b,c * a,,b,,,c,a -> a,b,c * a,b,c,-a -> b,c * a,b,c,-a,a -> b,c,a * a,+b,c -> a,b,c * a,b,=c,d -> c,d * a,b,c,= -> */ I've tried these variations with mixed results. According to my observations only the --protocol=+<item> syntax seems to be working as advertised. I wonder if it is wise to revert the Sailfish commit until this is tested more extensively. ``` $ firejail --protocol +netlink /usr/bin/wget https://github.com/netblue30/firejail/raw/master/README.md Error: invalid --protocol command line option $ firejail --debug --protocol=+netlink /usr/bin/wget https://github.com/netblue30/firejail/raw/master/README.md| tee fj.debug.log [...] $ grep " protocol" fj.debug.log Build protocol filter: netlink,unix,inet,inet6 sbox run: /run/firejail/lib/fseccomp protocol build netlink,unix,inet,inet6 /run/firejail/mnt/seccomp/seccomp.protocol Install protocol filter: netlink,unix,inet,inet6 $ firejail --debug --protocol=-inet /usr/bin/wget https://github.com/netblue30/firejail/raw/master/README.md| tee fj.debug.log [...] $ grep " protocol" fj.debug.log Build protocol filter: unix,inet,inet6 sbox run: /run/firejail/lib/fseccomp protocol build unix,inet,inet6 /run/firejail/mnt/seccomp/seccomp.protocol Install protocol filter: unix,inet,inet6 $ firejail --debug --protocol=-inet6 /usr/bin/wget https://github.com/netblue30/firejail/raw/master/README.md| tee fj.debug.log [...] $ grep " protocol" fj.debug.log Build protocol filter: unix,inet,inet6 sbox run: /run/firejail/lib/fseccomp protocol build unix,inet,inet6 /run/firejail/mnt/seccomp/seccomp.protocol Install protocol filter: unix,inet,inet6 $ firejail --debug --protocol=netlink /usr/bin/wget https://github.com/netblue30/firejail/raw/master/README.md| tee fj.debug.log [...] $ grep " protocol" fj.debug.log Build protocol filter: netlink,unix,inet,inet6 sbox run: /run/firejail/lib/fseccomp protocol build netlink,unix,inet,inet6 /run/firejail/mnt/seccomp/seccomp.protocol Install protocol filter: netlink,unix,inet,inet6 ```

gitea-mirror closed this issue 2026-05-05 09:11:20 -06:00

gitea-mirror commented 2026-05-05 09:11:22 -06:00

Author

Owner

Copy link

@rusty-snake commented on GitHub (Feb 28, 2021):

That's exactly the expected behaviour if you "Allow changing protocol list after initial set". Because of this behaviour change I already added a note to RELNOTES (but don't pushed it yet). The new behaviour is the same that we have for seccomp, private-bin, private-etc, private-opt, caps.keep, ... plus the +, - and = extras (which would be quite nice to have for the others too).

protocol was always special. If you want to add an entry to e.g. private-bin, you could simply write private-bin foo in your .local, while for protocol (and this was the only one) you need to copy the list and add foo. If you wanted to remove a protocol, you had to copy the list and remove foo. Now you need same as for all other lists. Copy it, remove foo and add ignore bar.

<!-- gh-comment-id:787430525 --> @rusty-snake commented on GitHub (Feb 28, 2021): That's exactly the expected behaviour if you "Allow changing protocol list after initial set". Because of this behaviour change I already added a note to RELNOTES (but don't pushed it yet). The new behaviour is the same that we have for `seccomp`, `private-bin`, `private-etc`, `private-opt`, `caps.keep`, ... plus the `+`, `-` and `=` extras (which would be quite nice to have for the others too). `protocol` was always special. If you want to add an entry to e.g. `private-bin`, you could simply write `private-bin foo` in your .local, while for `protocol` (and this was the only one) you need to copy the list and add `foo`. If you wanted to remove a protocol, you had to copy the list and remove `foo`. Now you need same as for all other lists. Copy it, remove `foo` and add `ignore bar`.

gitea-mirror commented 2026-05-05 09:11:24 -06:00

Author

Owner

Copy link

@ghost commented on GitHub (Mar 1, 2021):

@rusty-snake Thanks for the explanation, this change got me really confused. Changing the title, as this is obviously not a regression but new behaviour. In the mean time I've gone over our profiles and the only changes IMO are in transmission-daemon.profile (due to the redirect) and in chromium-common-hardened.inc. I'll prepare a PR for that shortly.

<!-- gh-comment-id:787751402 --> @ghost commented on GitHub (Mar 1, 2021): @rusty-snake Thanks for the explanation, this change got me really confused. Changing the title, as this is obviously not a regression but new behaviour. In the mean time I've gone over our profiles and the only changes IMO are in `transmission-daemon.profile` (due to the redirect) and in `chromium-common-hardened.inc`. I'll prepare a PR for that shortly.

gitea-mirror referenced this issue 2026-05-05 10:18:41 -06:00

[PR #2504] [CLOSED] mdwx: block memfd_create #4364

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

master

serialize_remounts_v2

landlock_v4

landlock

release-0.9.64

release-0.9.62

gitlab_ci

LTSbase

fred_ctests

docs

0.9.80

0.9.80-rc1

0.9.78

0.9.76

0.9.76-rc4

0.9.76-rc3

0.9.76-rc2

0.9.76-rc1

0.9.74

landlock-split

0.9.72

0.9.72rc1

0.9.70

0.9.68

0.9.68rc1

0.9.66

0.9.66rc1

0.9.64.4

0.9.64.2

0.9.64

0.9.64rc1

0.9.62.4

0.9.62.2

0.9.62

0.9.56.2-LTS

0.9.60

0.9.60-rc1

0.9.58.2

0.9.58

0.9.58-rc1

0.9.56-LTS-release

0.9.56-LTS

0.9.56

0.9.56-rc1

0.9.54

0.9.54-rc2

0.9.54-rc1

0.9.52

0.9.38.12

0.9.50

0.9.50-rc1

0.9.48

0.9.46

0.9.46-rc1

0.9.44.10

0.9.44.8

0.9.44.6

0.9.38.10

0.9.44.4

0.9.38.8

0.9.44.2

0.9.44

0.9.44-rc1

0.9.38.4

0.9.42

0.9.42-rc2

0.9.38.2

0.9.42-rc1

disable-globalcfg

0.9.40

0.9.40-rc1

0.9.38

0.9.38-rc1

0.9.36

0.9.36-rc1

0.9.34

0.9.34-rc1

0.9.32

0.9.32-rc1

0.9.30

0.9.30-rc1

Labels

Clear labels   

LTS merge

  

LTS merge

  

bug

  

bug

  

converted-to-discussion

  

doc-todo

  

documentation

  

duplicate

  

enhancement

  

file-transfer

  

firecfg

  

firejail-in-firejail

  

firetools

  

graphics

  

help wanted

  

information_old

  

installation

  

invalid

  

modif

  

moved

  

needinfo

  

networking

  

notabug

  

notourbug

  

old-version

  

overlayfs

  

packaging

  

profile-request

  

pull-request

Mirrored from GitHub Pull Request

  

question

  

question_old

  

removal

  

runtime-permissions

  

sandbox-ipc

  

security

  

stale

  

wiki

  

wiki

  

wontfix

  

wordpress

  

workaround

No labels

LTS merge

LTS merge

bug

bug

converted-to-discussion

doc-todo

documentation

duplicate

enhancement

file-transfer

firecfg

firejail-in-firejail

firetools

graphics

help wanted

information_old

installation

invalid

modif

moved

needinfo

networking

notabug

notourbug

old-version

overlayfs

packaging

profile-request

pull-request

question

question_old

removal

runtime-permissions

sandbox-ipc

security

stale

wiki

wiki

wontfix

wordpress

workaround

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

github-starred/firejail#2504

No description provided.