mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4928] keepassxc: cannot access Yubikeys #2822
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2822
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @seonwoolee on GitHub (Feb 11, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4928
Description
I use KeePassXC to open my KeePass database that is protected with a password, key file, and a challenge-response from my Yubikey. After the version 0.9.68 update, KeePassXC can no longer access my Yubikey when run under firejail. I have verified that it works fine when run without firejail.
I saw #4883 and the corresponding PR #4915 to add back
nou2f. I have tried putting bothignore nou2fandignore private-devin my~/.config/firejail/keepassxc.local, but it still doesn't work. I also tried commenting outprivate-devin/etc/firejail/keepassxc.profile, but that didn't work either. I'm not sure where the problem actually is, as that's the only line inkeepassxc.profilethat has changed recently. I assume the problem lies in some other file thatkeepass.profileincludes, but I'm not sure which.Steps to Reproduce
Run
firejail keepassxc, select my database, and then attempt to select my Yubikey as my hardware key. In the terminal it outputs the errorYubiKey: Failed to initialize USB interface.(full log at the end)I also tried this without a
globals.localor akeepassxc.local, and it didn't work. I also tried this without aglobals.localand justignore nou2finkeepassxc.local, and it still didn't work.Expected behavior
KeePassXC can access my Yubikey for Challenge-Response authentication
Actual behavior
KeePassXC cannot find my Yubikey
Behavior without a profile
Terminal output is uneventful and KeePassXC successfully finds my Yubikey.
Additional context
This only started occurring after the 0.9.68 update.
Environment
Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)Log
Output of
LC_ALL=C firejail /path/to/programOutput of
LC_ALL=C firejail --debug /path/to/program@rusty-snake commented on GitHub (Feb 11, 2022):
This is about keepassx (no c) not keepassxc.
@rusty-snake commented on GitHub (Feb 11, 2022):
No idea but can use test
ignore noinputignore include whitelist-run-common.incprotocol netlink@seonwoolee commented on GitHub (Feb 11, 2022):
Oops. My bad.
Well that's interesting. There's no
YubiKey: Failed to initialize USB interfaceerror in the terminal output, but it still fails to find my Yubikey.@rusty-snake commented on GitHub (Feb 11, 2022):
With all of them? Or just one?
@seonwoolee commented on GitHub (Feb 11, 2022):
That was for all of them.
I just tested all possible combinations of the three options (so 3x just one of them and 3x two of them). All combinations fail. The
protocol netlinkis responsible for making theYubikey: Failed to initialize USB interfacemessage go away, but it still can't find my Yubikey@rusty-snake commented on GitHub (Feb 11, 2022):
Then you will need to comment the profile and uncomment it line for line to find the problematic command.
@seonwoolee commented on GitHub (Feb 12, 2022):
So the minimal number of changes I needed to make this work was to eliminate
private-devand useprotocol netlink,unix. So I have addedignore private-devandprotocol netlink,unixto mykeepassxc.localShould I open a pull request to modify the current comment about
private-dev, which is@rusty-snake commented on GitHub (Feb 12, 2022):
Are you really sure
private-devbreak the detection of you yubikeys other then descripted?@seonwoolee commented on GitHub (Feb 13, 2022):
Yeah that was puzzling to me based on the current description of how
private-devis supposed to work, but I tested it multiple times andignore private-devis absolutely necessary for Yubikey detection and usage to work. It didn't matter if I had the Yubikey already plugged in before starting KeePassXC under firejail or if I plugged it after@kmk3 commented on GitHub (Feb 13, 2022):
@seonwoolee commented on Feb 13:
What does the yubikey show up as in /dev?
That is, what is the output of
ls -l /dev/<yubikey>?If it shows up as
/dev/hidrawNwith N > 9, this could be caused by #2723.@seonwoolee commented on GitHub (Feb 13, 2022):
By doing a
ls /devwith and without the Yubikey plugged in, I determined the Yubikey adds/dev/hidraw1and/dev/hidraw2. I then commented outignore private-devin mykeepassxc.localand ranfirejail --ignore=private-bin --profile=keepassxc ls -alh /dev, and/dev/hidraw1and/dev/hidraw2are definitely listed. So I don't understand why the heck KeePassXC can't find my Yubikey@kmk3 commented on GitHub (Feb 13, 2022):
@seonwoolee commented on Feb 13:
What are their permissions and the user:group owners outside/inside the
sandbox?
@seonwoolee commented on GitHub (Feb 13, 2022):
Outside the sandbox
Inside the sandbox, run as normal user
I tried
sudo firejail --ignore=private-bin --profile=keepassxc ls -alh /devand I getJust for fun I tried
sudo firejail keepassxcbut I get@seonwoolee commented on GitHub (Feb 17, 2022):
@kmk3 any thoughts?
@kmk3 commented on GitHub (Feb 18, 2022):
@seonwoolee commented on Feb 13:
65534:65534 is probably because of
noroot(root -> nobody) +private-etc(numeric output).
To clarify the ACLs now, based on a similar previous attempt from this comment:
What is the output of running the code below?
0:0 is probably because
norootdoes not apply when running as root. Also,private-binshould only affect /bin, /usr/bin, etc.@seonwoolee commented on GitHub (Feb 19, 2022):
@kmk3
I had to change the hid IDs because they changed across the reboot, but here's what I get
You checkudevgroups function doesn't work as intended. There is no line with "GROUP" in the output of
udevadm test "$(udevadm info --query=path --name="$1")".Here's the output of that command, as root
@DatAres37 commented on GitHub (May 15, 2022):
I can confirm it works with
ignore nou2f, ignore private-dev, protocol netlink,unix, but it doesn't work if you pull the key while KeepassXC is open and plug it back in unfortunately.@andreystepanov commented on GitHub (Jan 19, 2023):
I'm having the same issue
@haplo commented on GitHub (Jan 16, 2024):
I was having the same issue (but with an Onlykey) and it worked with
ignore private-devplusprotocol netlink.@sashee commented on GitHub (Mar 30, 2024):
If I start keepassxc with this command then Yubikey works and it also detects when it is inserted/removed: