github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #4714] dhclient-script needs ip, which is disabled in disable-common.inc #2762

New issue

Closed

opened 2026-05-05 09:25:28 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 09:25:28 -06:00

Owner

Originally created by @kris7t on GitHub (Nov 25, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4714

Description

In 483fe0622b (diff-ceabc68b897d509c864b3d4c515111eeb4f7677549ff9a815dec3c8ebfdf2839R521), the ip program was disabled by default in disble-common.inc. This prevents /usr/bin/dhclient-script from running properly. Instead, it outputs error messages such as

/sbin/dhclient-script: line 248: /sbin/ip: Permission denied
/sbin/dhclient-script: line 276: /sbin/ip: Permission denied
/sbin/dhclient-script: line 408: /sbin/ip: Permission denied
/sbin/dhclient-script: line 414: /sbin/ip: Permission denied
/sbin/dhclient-script: line 414: /sbin/ip: Permission denied
/sbin/dhclient-script: line 414: /sbin/ip: Permission denied
/sbin/dhclient-script: line 414: /sbin/ip: Permission denied
/sbin/dhclient-script: line 414: /sbin/ip: Permission denied
/sbin/dhclient-script: line 414: /sbin/ip: Permission denied
/sbin/dhclient-script: line 422: /sbin/ip: Permission denied
/sbin/dhclient-script: line 184: /sbin/ip: Permission denied

Steps to Reproduce

Run firejail with any profile than includes disable-common.inc with dhcp client, such as

firejail --profile=/etc/firejail/chromium.profile --net=br0 --ip=dhcp /usr/bin/chromium

Replace br0 in the above with a bridge interface that has access to a DHCP server.

Expected behavior

dhclient should finish successfully and acquire an IP address for the sandbox.

Actual behavior

dhclient fails to run, which leads to network connectivity problems in the sandbox.

Behavior without a profile

Running with no profile or with a profile that does not include disable-common.inc allows firejail to proceed with no error.

Additional context

It seems we are applying the file denylist even for dhclient, which otherwise runs as root. One solution would be to only apply the denylist after the container has acquired an IP address, but that might loosen the sandbox a bit too much. A more elegant way (but I can't easily come up with a plan how to implement it) would be to specifically allow dhclient, dhclient-script, ip (an whatever other utilities dhclient-script might need) transiently.

As a workaround, I added

ignore blacklist ${PATH}/ip

to globals.local, but this is a inferior solution (since ip keeps being allowed even after we have acquired an IP address).

Environment

Arch Linux
Firejail version 0.9.67
Running from commit 483fe0622b

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).

Log

Output of firejail --profile=/etc/firejail/chromium.profile --net=br0 --ip=dhcp /usr/bin/chromium

Reading profile /etc/firejail/chromium.profile
Reading profile /home/kris/.config/firejail/chromium.local
Reading profile /home/kris/.config/firejail/net-untrusted.inc
Reading profile /etc/firejail/globals.local
Reading profile /etc/firejail/chromium-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-run-common.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /home/kris/.config/firejail/whitelist-runuser-common.local
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 637058, child pid 637061

Interface        MAC                IP               Mask             Status
lo                                  127.0.0.1        255.0.0.0        UP

Warning: not remounting /var/lib/docker/btrfs
Warning: not remounting /var/lib/docker/btrfs
/sbin/dhclient-script: line 248: /sbin/ip: Permission denied
/sbin/dhclient-script: line 248: /sbin/ip: Permission denied
/sbin/dhclient-script: line 276: /sbin/ip: Permission denied
/sbin/dhclient-script: line 408: /sbin/ip: Permission denied
/sbin/dhclient-script: line 414: /sbin/ip: Permission denied
/sbin/dhclient-script: line 414: /sbin/ip: Permission denied
/sbin/dhclient-script: line 414: /sbin/ip: Permission denied
/sbin/dhclient-script: line 414: /sbin/ip: Permission denied
/sbin/dhclient-script: line 414: /sbin/ip: Permission denied

Originally created by @kris7t on GitHub (Nov 25, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4714  ### Description In https://github.com/netblue30/firejail/commit/483fe0622bdc309e41a58c887dc4a6a5da4720ae#diff-ceabc68b897d509c864b3d4c515111eeb4f7677549ff9a815dec3c8ebfdf2839R521, the `ip` program was disabled by default in `disble-common.inc`. This prevents `/usr/bin/dhclient-script` from running properly. Instead, it outputs error messages such as ``` /sbin/dhclient-script: line 248: /sbin/ip: Permission denied /sbin/dhclient-script: line 276: /sbin/ip: Permission denied /sbin/dhclient-script: line 408: /sbin/ip: Permission denied /sbin/dhclient-script: line 414: /sbin/ip: Permission denied /sbin/dhclient-script: line 414: /sbin/ip: Permission denied /sbin/dhclient-script: line 414: /sbin/ip: Permission denied /sbin/dhclient-script: line 414: /sbin/ip: Permission denied /sbin/dhclient-script: line 414: /sbin/ip: Permission denied /sbin/dhclient-script: line 414: /sbin/ip: Permission denied /sbin/dhclient-script: line 422: /sbin/ip: Permission denied /sbin/dhclient-script: line 184: /sbin/ip: Permission denied ``` ### Steps to Reproduce Run `firejail` with any profile than includes `disable-common.inc` with dhcp client, such as ```sh firejail --profile=/etc/firejail/chromium.profile --net=br0 --ip=dhcp /usr/bin/chromium ``` Replace `br0` in the above with a bridge interface that has access to a DHCP server. ### Expected behavior `dhclient` should finish successfully and acquire an IP address for the sandbox. ### Actual behavior `dhclient` fails to run, which leads to network connectivity problems in the sandbox. ### Behavior without a profile Running with no profile or with a profile that does not include `disable-common.inc` allows firejail to proceed with no error. ### Additional context It seems we are applying the file denylist even for `dhclient`, which otherwise runs as root. One solution would be to only apply the denylist after the container has acquired an IP address, but that might loosen the sandbox a bit too much. A more elegant way (but I can't easily come up with a plan how to implement it) would be to specifically allow `dhclient`, `dhclient-script`, `ip` (an whatever other utilities `dhclient-script` might need) transiently. As a workaround, I added ``` ignore blacklist ${PATH}/ip ``` to `globals.local`, but this is a inferior solution (since `ip` keeps being allowed even after we have acquired an IP address). ### Environment - Arch Linux - Firejail version 0.9.67 - Running from commit 483fe0622bdc309e41a58c887dc4a6a5da4720ae ### Checklist  - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). ### Log <details> <summary>Output of <code>firejail --profile=/etc/firejail/chromium.profile --net=br0 --ip=dhcp /usr/bin/chromium</code></summary> <p> ``` Reading profile /etc/firejail/chromium.profile Reading profile /home/kris/.config/firejail/chromium.local Reading profile /home/kris/.config/firejail/net-untrusted.inc Reading profile /etc/firejail/globals.local Reading profile /etc/firejail/chromium-common.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-run-common.inc Reading profile /etc/firejail/whitelist-runuser-common.inc Reading profile /home/kris/.config/firejail/whitelist-runuser-common.local Reading profile /etc/firejail/whitelist-usr-share-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 637058, child pid 637061 Interface MAC IP Mask Status lo 127.0.0.1 255.0.0.0 UP Warning: not remounting /var/lib/docker/btrfs Warning: not remounting /var/lib/docker/btrfs /sbin/dhclient-script: line 248: /sbin/ip: Permission denied /sbin/dhclient-script: line 248: /sbin/ip: Permission denied /sbin/dhclient-script: line 276: /sbin/ip: Permission denied /sbin/dhclient-script: line 408: /sbin/ip: Permission denied /sbin/dhclient-script: line 414: /sbin/ip: Permission denied /sbin/dhclient-script: line 414: /sbin/ip: Permission denied /sbin/dhclient-script: line 414: /sbin/ip: Permission denied /sbin/dhclient-script: line 414: /sbin/ip: Permission denied /sbin/dhclient-script: line 414: /sbin/ip: Permission denied ``` </p> </details>

gitea-mirror

2026-05-05 09:25:28 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 09:25:31 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 30, 2021):

OOPS! Fixed, thanks!

@netblue30 commented on GitHub (Nov 30, 2021): OOPS! Fixed, thanks!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2762

No description provided.

Rows
Columns