mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4331] blacklisting ${HOME}/.netrc blocks internet access for SRBMiner 0.7.5+ #2625
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2625
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @christianskou07 on GitHub (Jun 3, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4331
Bug and expected behavior
Running SRBMiner with firejail using the default profile blocks internet access causing the miner not to work properly (crashing upon startup). However, for a period of time it was working without any issues.
I have narrowed it down to whether or not the line
blacklist ${HOME}/.netrcin/etc/firejail/disable-common.incis commented out or not makes the difference.SRBMiner 0.7.5 and 0.7.6.
To have internet access and work as usual. Although I know this could make me look rather naive.
No profile and disabling firejail
firejail --noprofile /path/to/programin a terminal?Works as expected.
Reproduce
Steps to reproduce the behavior:
Setup SRBMiner using
--setup, thereafter run the generated start script with firejail.Environment
lsb_release -a,screenfetchorcat /etc/os-release)firejail --version) exclusive or used git commit (git rev-parse HEAD)Checklist
https://github.com/netblue30/firejail/issues/1139)--profile=PROFILENAMEis used to set the right profile.LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAMto get english error-messages.browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.debug output
It should be noted that a rather large part of
/etc/firejail/disable-common.incis commented out when reading the output below.@rusty-snake commented on GitHub (Jun 3, 2021):
SRBMiner doesn't have a profile yet. Request one in #1139 or write it yourself.
Then add
noblacklist ${HOME}/.netrcif you write a custom profile.@christianskou07 commented on GitHub (Jun 3, 2021):
Wouldn't that introduce a security risk?
@rusty-snake commented on GitHub (Jun 3, 2021):
What is a security risk for you? Every additional file that can be accessed is possible a theoretical security risk. On the other hand keep in mind that you run it without
whitelist,dbus-{user,system} none,net none,private-tmp, … and that it does not work without access to it. Allowing firefox to usechrootis a security risk but firefox needs it. W^X violations are security risks, but a lot programs (mostly OpenGL/Vulkan and interpreters like python or perl) need W&X mem.You can also make it
read-onlyand FYI that the current list:@christianskou07 commented on GitHub (Jun 4, 2021):
Part of what you are saying is above my knowledge level, so excuse my ignorance.
As
.netrcis a file which potentially could contain rather sensitive information, I consider it a security risk.There should be no reason for SRBMiner to need any sort of access to
${HOME}/.netrc, and afaik it doesn't do so either, hence I find it odd that this is the line causing the whole issue.The other thing is the fact that it has worked with no issues running SRBMiner with firejail, and suddenly out of the blue it doesn't.
@rusty-snake commented on GitHub (Jun 4, 2021):
Was there an update of SRBMiner/firejail? What happens if you remove/rename
~/.netrc?@christianskou07 commented on GitHub (Jun 4, 2021):
That was my first thought too, but no.
I have gotten it a little closer, however it is still unclear to me what has happened. Just to make it clear, I have no experience with
~/.netrcand I have never used it before (at least not what I know of).However, it seems like an empty
~/.netrcwas created yesterday, and if I remove it I'm allowed to run SRBMiner with firejail and its default profile.When
~/.netrcis blacklisted and if~/.netrcexists, then I can't run SRBMiner with firejail. If~/.netrcdoesn't exists and is still blacklisted, then I can run SRBMiner with firejail.Not that I think it is relevant, however I feel the need to mention it as it was almost the second after I used the script inhere the error occurred: https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#runfile-verifications
@rusty-snake commented on GitHub (Jun 4, 2021):
If it is empty there is no risk.
Looks like a bug in SRBMiner. A program should not die if it gets
EACCES.Well at least
ENOENTis handled correctly by SRBMiner.@christianskou07 commented on GitHub (Jun 4, 2021):
Thank you for helping. Just to make sure you've seen it, I edited my comment after a little while including the link from nvidia.
Would you by any chance have a guess why an empty
~/.netrcwould be created and why SRBMiner would like to access it?@rusty-snake commented on GitHub (Jun 4, 2021):
If you used any of this profiles
grep -l -E "^mkfile \${HOME}\/\.netrc" /etc/firejail/* ~/.config/firejail/*, it was firejail. If not I've no idea.IDK how SRBMiner works and which libraries/externl programs it use. But it sound ok that it looks into netrc if it has any kind of support for it.
@christianskou07 commented on GitHub (Jun 4, 2021):
All I get is
grep: /home/chr1s/.config/firejail/*: No such file or directory.Afaik I don't think it has any support for it, but that may be a subject to another discussion.
@rusty-snake commented on GitHub (Jun 4, 2021):
Depends on nullglob behaviour. Anyway
grep -l -E "^mkfile \${HOME}\/\.netrc" /etc/firejail/*.@christianskou07 commented on GitHub (Jun 4, 2021):
I tried that as well, but that gives me pure nothing...
@rusty-snake commented on GitHub (Jun 4, 2021):
Gotcha!
$need double escapegrep -l -E "^mkfile \\\${HOME}\/\.netrc" /etc/firejail/*.@christianskou07 commented on GitHub (Jun 4, 2021):
Yup,
/etc/firejail/mpv.profileshows up, and if I recall I might have done something in the ballpark offirejail --noprofile --noblacklist=/sys/module mpv@rusty-snake commented on GitHub (Jun 4, 2021):
Running it with
--noprofileactually does not create~/.netrchowever one (accidental) call w/o--noprofiledoes.... , use
whitelistorprivate.@christianskou07 commented on GitHub (Jun 4, 2021):
I guess it makes more sense that I have tried to do it w/o
--noprofile, as I knew it would work with.As of right now, I have removed the
~/.netrcfile and kept it blacklisted while using the default profile with no issues. Either I'll look into making a more tailored profile for both SRBMiner and NBMiner or hope someone else are interested in doing the same thing.Nonetheless, you've been a great help. Thank you.
@rusty-snake commented on GitHub (Jun 4, 2021):
https://github.com/netblue30/firejail/blob/master/etc/templates/profile.template
^ Just to make sure you're aware of the template.
@christianskou07 commented on GitHub (Jun 4, 2021):
Noted! Thanks.