github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 22:01:33 -06:00

[GH-ISSUE #4306] firejail took over the default gateway IP #2619

New issue

Closed

opened 2026-05-05 09:16:57 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:16:57 -06:00

Owner

Originally created by @mdkent on GitHub (May 25, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4306

Bug and expected behavior
Rather than aborting, firejail took over the default gateway IP leading to a site wide issue.

Could firejail do a sanity check to make sure it's not assigning the default gateway IP to the interface?

Reproduce

# firejail --net=ens3 --profile=/etc/firejail/demo.profile bash

resulted in

Reading profile /etc/firejail/demo.profile
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Warning: noroot option is not available
Parent pid 16929, child pid 16930
The new log directory is /proc/16930/root/var/log

Interface        MAC                IP               Mask             Status
lo                                  127.0.0.1        255.0.0.0        UP
eth0-16929       ea:8a:3a:e1:07:fd  10.20.0.1        255.255.240.0    UP
Default gateway 10.20.0.1

Child process initialized in 443.03 ms
[test] root@foo:~#

Environment

ubuntu 18.04
firejail version 0.9.52

Originally created by @mdkent on GitHub (May 25, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4306 **Bug and expected behavior** Rather than aborting, firejail took over the default gateway IP leading to a site wide issue. Could firejail do a sanity check to make sure it's not assigning the default gateway IP to the interface? **Reproduce** ``` # firejail --net=ens3 --profile=/etc/firejail/demo.profile bash ``` resulted in ``` Reading profile /etc/firejail/demo.profile Reading profile /etc/firejail/default.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc Warning: noroot option is not available Parent pid 16929, child pid 16930 The new log directory is /proc/16930/root/var/log Interface MAC IP Mask Status lo 127.0.0.1 255.0.0.0 UP eth0-16929 ea:8a:3a:e1:07:fd 10.20.0.1 255.255.240.0 UP Default gateway 10.20.0.1 Child process initialized in 443.03 ms [test] root@foo:~# ``` **Environment** ``` ubuntu 18.04 firejail version 0.9.52 ```

gitea-mirror closed this issue

2026-05-05 09:16:58 -06:00

gitea-mirror commented

2026-05-05 09:17:00 -06:00

Author

Owner

@netblue30 commented on GitHub (May 26, 2021):

The default gw information is extracted from /proc/self/net/route. Do a "cat /proc/self/net/route" in a terminal and post it here. This could be a bug on our side.

@netblue30 commented on GitHub (May 26, 2021): The default gw information is extracted from /proc/self/net/route. Do a "cat /proc/self/net/route" in a terminal and post it here. This could be a bug on our side.

gitea-mirror commented

2026-05-05 09:17:01 -06:00

Author

Owner

@mdkent commented on GitHub (May 26, 2021):

# cat /proc/self/net/route
Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT
ens3	00000000	0100140A	0003	0	0	0	00000000	0	0	0
ens3	0000140A	00000000	0001	0	0	0	00F0FFFF	0	0	0
ens4	000014AC	00000000	0001	0	0	0	00F0FFFF	0	0	0

Thanks for looking!

@mdkent commented on GitHub (May 26, 2021): ``` # cat /proc/self/net/route Iface Destination Gateway Flags RefCnt Use Metric Mask MTU Window IRTT ens3 00000000 0100140A 0003 0 0 0 00000000 0 0 0 ens3 0000140A 00000000 0001 0 0 0 00F0FFFF 0 0 0 ens4 000014AC 00000000 0001 0 0 0 00F0FFFF 0 0 0 ``` Thanks for looking!

gitea-mirror commented

2026-05-05 09:17:02 -06:00

Author

Owner

@netblue30 commented on GitHub (May 27, 2021):

Yes, that's our bug! Fixed in the commit above, thanks!

@netblue30 commented on GitHub (May 27, 2021): Yes, that's our bug! Fixed in the commit above, thanks!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2619

No description provided.

Rows
Columns