mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4576] Requesting rework of geekbench.profile #2708
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2708
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ghost on GitHub (Sep 23, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4576
Description
Current profile for the crossplatform benchmarking utility Geekbench is not up-to-date and unusable.
Steps to Reproduce
Expected behavior
Geekbench should run confined to its jail.
Actual behavior
Denies execution during firejail start up procedure.
Behavior without a profile
Geekbench begins executing as expected.
Additional context
Geekbench exists in different versions. The current version is 5.x
Environment
Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)Log
@smitsohu commented on GitHub (Sep 23, 2021):
That's curious. Does
firejail --noprofile --private-libwork?If not, what does
ls -l /usr/bin/firejailsay?@ghost commented on GitHub (Sep 23, 2021):
firejail --noprofile --private-libls -l /usr/bin/firejail@smitsohu commented on GitHub (Sep 23, 2021):
Thanks! I think this is a bug. Probably the reason is that our helper
flddis not a member of thefirejailgroup.@ghost commented on GitHub (Sep 23, 2021):
Great, if it gets solved in the end all is well. What is the estimated timeframe for a fix to get merged to master? Is there any kind of manual workaround that can be applied in the meantime?
@rusty-snake commented on GitHub (Sep 23, 2021):
ignore private-lib@ghost commented on GitHub (Sep 23, 2021):
For now, of my programs, only geekbench is affected. What would be the
ignore private-libequivalent for the *.local file.@rusty-snake commented on GitHub (Sep 23, 2021):
echo "ignore private-lib" >> ~/.config/firejail/geekbench.localThis will affect all program if their profile contains
private-libas I understand.@ghost commented on GitHub (Sep 23, 2021):
The geekbench binary is located at
/opt/geekbench/geekbench5@rusty-snake commented on GitHub (Sep 23, 2021):
Does anyone know if
private-bin bash,geekbenc*,shis intended or is this a typo and should begeekbench*(with a "h")?@ghost commented on GitHub (Sep 23, 2021):
Error: no suitable /sbin/geekbench executable found@rusty-snake commented on GitHub (Sep 23, 2021):
452916a894/src/firejail/fs_bin.c (L162-L169)@rusty-snake commented on GitHub (Sep 23, 2021):
Does
firejail --profile=geekbench /opt/geekbench/geekbench5work?@ghost commented on GitHub (Sep 23, 2021):
@rusty-snake commented on GitHub (Sep 23, 2021):
Do you have a
geekbenchfile/dir in your cwd?@ghost commented on GitHub (Sep 23, 2021):
Our current geekbench.profile has
private-opt none, which stops the symlink in /usr/bin to find /opt/geekbench/geekbench5. Have you triedprivate-opt geekbenchyet?@ghost commented on GitHub (Sep 23, 2021):
Ups, yes, I was in
/sbin.@rusty-snake commented on GitHub (Sep 23, 2021):
🤦 was to obvious
452916a894/etc/profile-a-l/geekbench.profile (L47)Either use
private-opt geekbenchor, ifdu -sc /opt/geekbenchis more than a few MB,ignore private-opt.EDIT: Did not saw @glitsj16 comment until now.
@ghost commented on GitHub (Sep 23, 2021):
What should the geekbench.local look now?
Results in:
@rusty-snake commented on GitHub (Sep 23, 2021):
All 4 lines (2
noblacklistand 2ignore).@ghost commented on GitHub (Sep 23, 2021):
@rusty-snake commented on GitHub (Sep 23, 2021):
And with
firejail --profile=geekbench /opt/geekbench/geekbench5?@ghost commented on GitHub (Sep 23, 2021):
With
firejail --profile=geekbench /opt/geekbench/geekbench5geekbench starts!@ghost commented on GitHub (Sep 23, 2021):
ignore private-libwas for the issue with the helper.But why does just
geekbenchnot work if I haveignore private-optandnoblacklist /sbin?@ghost commented on GitHub (Sep 23, 2021):
Just out of curiosity, did you create the
firejailgroup yourself? I'm on Arch Linux too and can't recall ever seeing that when installing firejail via pacman. Not that @smitsohu 's reasoning is in any way off regarding our fldd helper. But it might be confusing for other AL users when seeing this thread.@ghost commented on GitHub (Sep 23, 2021):
https://wiki.archlinux.org/title/Firejail#Hardening_Firejail
https://firejail.wordpress.com/documentation-2/basic-usage/#suid
@ghost commented on GitHub (Sep 25, 2021):
I still have some questions.
firejail --profile=geekbench /opt/geekbench/geekbench5when I habeignore private-optandnoblacklist /sbin@smitsohu commented on GitHub (Sep 25, 2021):
There is a fix in master for the
private-libpart, you can give it a try.@rusty-snake commented on GitHub (Sep 25, 2021):
That's what I want to findout first. My guess is
private-bin, so try toignoreit.What does
firejail --profile=geekbench /proc/self/fd/3 /sbin 3</bin/lsshow?@ghost commented on GitHub (Sep 25, 2021):
With the above setting geekbench starts.
With the above settings, including
ignore private-binfirejail --profile=geekbench /proc/self/fd/3 /sbin 3</bin/lsoutbuts all binaries.Without
ignore private-bin:@ghost commented on GitHub (Sep 29, 2021):
While we are on the topic, geekbench does not seem to have permissions to save the registration key if you have bought a licence.
@rusty-snake commented on GitHub (Sep 29, 2021):
Where and how does it store the license key? Does it need additional
whitelists, libraries or D-Bus access?edit: um, yes then it is clear what the problem is
6988a8027b/etc/profile-a-l/geekbench.profile (L54)edit2: adding
read-write ${HOME}/.foo/bar/geekbench(together withmkdir) will not make it persistent withoutwhitelist.@ghost commented on GitHub (Sep 29, 2021):
I have no idea where it is trying to save the key. How would I go about finding that out?
@rusty-snake commented on GitHub (Sep 29, 2021):
6988a8027b/etc/templates/profile.template (L62-L73)@ghost commented on GitHub (Sep 29, 2021):
Geekbench without any additonal parameters will not try to save the licence and Geekbench called via:
firejail --name=test --profile=geekbench --private /opt/geekbench/geekbench5 --unlock email@address.com xxxxx-xxxxx-xxxxx-xxxxx-xxxxx-xxxxx-xxxxx-xxxxx-xxxxxwill immediately exit with the following message.Geekbench is not an interactive program I can just leave running.
I might just write the support.
@rusty-snake commented on GitHub (Sep 29, 2021):
firejail --name=test --ignore=private-bin --profile=geekbench --private /bin/sh -c "/opt/geekbench/geekbench5 --unlock email@address.com xxxxx-xxxxx-xxxxx-xxxxx-xxxxx-xxxxx-xxxxx-xxxxx-xxxxx && tree -a"(or&& ls -lRa).@ghost commented on GitHub (Sep 29, 2021):
I wrote the support, maybe they are willing to give us a shortcut to figuring this out.
@rusty-snake commented on GitHub (Sep 29, 2021):
&&->;firejail --name=test --ignore=private-bin --profile=geekbench --private /bin/sh -c "/opt/geekbench/geekbench5 --unlock email@address.com xxxxx-xxxxx-xxxxx-xxxxx-xxxxx-xxxxx-xxxxx-xxxxx-xxxxx ; tree -a"@ghost commented on GitHub (Sep 29, 2021):
@rusty-snake commented on GitHub (Sep 29, 2021):
It isn't a filesystem operation (most likely). I should know this sicen https://github.com/netblue30/firejail/issues/4576#issuecomment-930466884.firejail --ignore=private-bin --ignore=read-only --profile=geekbench --private /bin/sh -c "/opt/geekbench/geekbench5 --unlock <email> <key> ; ls -lRa"firejail --ignore="dbus-user none" --profile=geekbench /opt/geekbench/geekbench5 --unlock <email> <key>firejail --noprofile --private /bin/sh -c "/opt/geekbench/geekbench5 --unlock <email> <key> ; ls -lRa"/opt/geekbench/geekbench5 --unlock <email> <key>@ghost commented on GitHub (Sep 29, 2021):
There it is! It's
~/.geekbench5@rusty-snake commented on GitHub (Sep 29, 2021):
Can you try this. (note the
read-writemust come after theread-onlytherefore it does not work from a .local).@ghost commented on GitHub (Sep 29, 2021):
I needed to modify the patch a little, since it seems the
ld.so.preloadpart hasn't reached Arch, yet! Also profiles are stored in/etc/firejail/*for me on Arch!Now geekbench runs smoothly!