mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4713] Can't mount using firejail #2761
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2761
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Kcchouette on GitHub (Nov 25, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4713
Description
Hello,
using firejail I can't mount with rclone application
Steps to Reproduce
Steps to reproduce the behavior
LC_ALL=C firejail --noprofile --ignore=quiet --debug rclone mount "rcloneconf:/Font/" ~/test/~/test/lsis empty too)Expected behavior
Without firejail, rclone correctly mount the directory
Actual behavior
It doesn't mount the directory
Behavior without a profile
What changed calling
LC_ALL=C firejail --noprofile /path/to/programin a terminal? NothingAdditional context
Any other detail that may help to understand/debug the problem
Environment
Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)Log
Output of
LC_ALL=C firejail /path/to/programOutput of
LC_ALL=C firejail --debug /path/to/program@rusty-snake commented on GitHub (Nov 25, 2021):
Mounting is a privileged task, how does rclone get CAP_SYS_ADMIN? userns? suid? setcap? Or is it a FUSE implementation? Did you modified firejail.config?
@Kcchouette commented on GitHub (Nov 25, 2021):
I have exactly this file: https://raw.githubusercontent.com/netblue30/firejail/0.9.66/etc/firejail.config
Of what I am seeing, they use
/dev/fuse: https://github.com/rclone/rclone/blob/master/contrib/docker-plugin/managed/config.json@rusty-snake commented on GitHub (Nov 25, 2021):
Does it work with the noprofile.profile?
@Kcchouette commented on GitHub (Nov 25, 2021):
No, the log above is using
--noprofile@rusty-snake commented on GitHub (Nov 25, 2021):
noprofile.profile not
--noprofile.@Kcchouette commented on GitHub (Nov 25, 2021):
It seems not:
@rusty-snake commented on GitHub (Nov 25, 2021):
If no one else has an idea, it seems like rclone does not work with firejail (generally).
@Kcchouette commented on GitHub (Nov 25, 2021):
someone show me this weird trick:
if you join the firejail ID of rclone mount using bash:
i can see the content 🤔
@rusty-snake commented on GitHub (Nov 25, 2021):
Ohh, you expected an mount operation inside the sandbox to take effect on your system (outside the sandbox and it's mount name space).
No, this does not work. And it doesn't make sense to put a program in a "sandbox" which allows things like that.
@rusty-snake commented on GitHub (Nov 26, 2021):
So if you run
firejail --noprofile bash, runrclone ...inside it andlsinside it, you see it. But if youlsin a second terminal, you don't see it. Right? That's what to expect and what you want.@Kcchouette commented on GitHub (Nov 26, 2021):
yes, but I was expecting that the
lsin the 2nd terminal to work@rusty-snake commented on GitHub (Nov 26, 2021):
I think we can close here. If we would mount
/withMS_SHARED | MS_RECto allow a sandbox to propagate mounts to the host (which also makes a lot of trouble and possible CVEs) the sandbox would be useless (a program could just mountbad-bashrcover~/.bashrcinstead of~/test).