mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4241] wireshark: Error: You do not have permission to capture on device #2592
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2592
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @aminvakil on GitHub (May 4, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4241
Bug and expected behavior
Cannot monitor traffic using wireshark
Monitor traffic
No profile and disabling firejail
firejail --noprofile /path/to/programin a terminal?It works without profile.
/usr/bin/vlc)?It works this way too.
Reproduce
Steps to reproduce the behavior:
firejail PROGRAMERROREnvironment
firejail --version) exclusive or used git commit (git rev-parse HEAD)Checklist
https://github.com/netblue30/firejail/issues/1139)--profile=PROFILENAMEis used to set the right profile.LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAMto get english error-messages.browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.$ firejail --debug /usr/bin/wireshark
@rusty-snake commented on GitHub (May 4, 2021):
Does one of the following commands work?
firejail --ignore=seccomp /usr/bin/wiresharkfirejail --ignore=caps.keep /usr/bin/wiresharkfirejail --ignore=apparmor /usr/bin/wiresharkfirejail --ignore=seccomp --ignore=caps.keep --ignore=apparmor --ignore=private-dev /usr/bin/wiresharkThe libGl errors are caused by
no3dbecause you use wayland (right?). They are unrelated to this. There are many program with them.@aminvakil commented on GitHub (May 4, 2021):
The ones with tick on them works.
firejail --ignore=seccomp /usr/bin/wiresharkfirejail --ignore=caps.keep /usr/bin/wiresharkfirejail --ignore=apparmor /usr/bin/wiresharkfirejail --ignore=seccomp --ignore=caps.keep --ignore=apparmor --ignore=private-dev /usr/bin/wiresharkSo should I just create a PR disabling
seccompin its profile?@rusty-snake commented on GitHub (May 4, 2021):
Probably yes, but check your syslog first.
General: Never disable
seccompbecause a program dies with it. This can be fixed by adding a exception for only one syscall in 90% of the cases and with exceptions for two or more syscalls for the rest.Here is it special because
seccompimplies NNP IIRC but those privilege issues are a edge case (I know only chromium until now).@aminvakil commented on GitHub (May 4, 2021):
I will create a PR tomorrow, meanwhile I would appreciate it if you could see output of my
journalctl -fwithseccompenabled (not working)$ journalctl -f
and without
seccomp(working)@rusty-snake commented on GitHub (May 4, 2021):
If there would be something, it would look like
2431d8ba33/etc/templates/syscalls.txt (L94)The
syscall=54in your second snippet issetsockoptwhich isn't blocked byseccomp.@aminvakil commented on GitHub (May 4, 2021):
I'm not sure if I understood you or not, but changing
seccomptoseccomp !setsockoptstill prevents the wireshark from gathering traffic.@aminvakil commented on GitHub (May 5, 2021):
@rusty-snake Thanks for your help on finding and fixing the issue!
@oknyshuk commented on GitHub (Oct 6, 2023):
wireshark doesn't work for me in firejail. I'm on Arch, using linux-hardened
@ghost commented on GitHub (Oct 6, 2023):
@k1gen
Are you on firejail 0.9.72? Building from git? Just did a check on the wireshark profile and there's an ommission that needs to be corrected in git.
2a8621cd94/etc/inc/disable-common.inc (L580-L583)wireshark needs access to that blacklisted
${PATH}/dumpcap. I'll open a PR to fix that. But if you're on 0.9.72 the situation is different and the above doesn't apply. Could you post used version, exact command and output here please?@oknyshuk commented on GitHub (Oct 6, 2023):
@glitsj16 https://paste.rs/mFFLG.txt
@ghost commented on GitHub (Oct 6, 2023):
@k1gen
The output related to libEGL stems from the
no3din wireshark.profile. That's to be expected and can safely be ignored. But lines 45 & 46 of your paste make me wonder if your user is in thewiresharkgroup. Check the Arch Wiki for details.@oknyshuk commented on GitHub (Oct 6, 2023):
the
no3dstuff I did ignore, but my user is in thewiresharkgroup, and everything works without a sandbox@ghost commented on GitHub (Oct 6, 2023):
You mentioned using
linux-hardened. That might be interfering/needing something extra in thecaps.keep dac_override,dac_read_search,net_admin,net_raw, not sure. Anything in journalctl pointing to that?@aminvakil commented on GitHub (Oct 7, 2023):
OP here :)
I can confirm the problem exists on
linux-hardenedas well.@aminvakil commented on GitHub (Oct 7, 2023):
Ah, I just tested and the problem still happens with linux-lts, so
linux-hardenedis irrelevant.@aminvakil commented on GitHub (Oct 7, 2023):
Manually changing
/etc/firejail/wireshark.profileas mentioned in https://github.com/netblue30/firejail/pull/6038 did not work either.(Adding
noblacklist ${PATH}/dumpcapto/etc/firejail/wireshark.profile)@aminvakil commented on GitHub (Oct 7, 2023):
https://paste.rs/Kq8Ns.bash
@kmk3 commented on GitHub (Oct 10, 2023):
It opens just fine with firejail-git on Artix.
Does the error still happen if using firejail-git?
Does it work with the following?
@oknyshuk commented on GitHub (Oct 10, 2023):
@kmk3 firejail-git worked for me even without
--ignore='include globals.local' --private@aminvakil commented on GitHub (Oct 10, 2023):
I can also confirm firejail-git worked without anything on Arch Linux.
@oknyshuk commented on GitHub (Nov 20, 2023):
it's broken again:
works fine without sandbox. I'm on
3c303ab1dc@ghost commented on GitHub (Nov 20, 2023):
@k1gen What do you have in your wireshark.local exactly? Is that where you've added
dbus-user.talk org.freedesktop.portal.Desktop?On my Arch Linux box wireshark 4.2.0-1 runs/works just fine with firejail-git. I even hardened it to use a fully whitelisting profile via the below wireshark.local:
But, again, my user is in the
wiresharkgroup. Unsure if you did similarly...@oknyshuk commented on GitHub (Nov 21, 2023):
@oknyshuk commented on GitHub (Dec 5, 2023):
hey, I'm still having this issue on
linux-clear6.6.4@oknyshuk commented on GitHub (Jan 23, 2024):
this is still an issue