mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4991] firefox: cannot access PGP card using GPG #2847
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2847
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @polcak on GitHub (Feb 28, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4991
Description
This is very likely a duplicate of #4107 or both bugs have the same root. I originally used Gentoo sys-apps/firejail-0.9.64.4 and recently updated to sys-apps/firejail-0.9.68. My gpg card used to work in Firefox with local profile. It does not work anymore (very likely after the update, let me know if I should check).
Steps to Reproduce
Steps to reproduce the behavior
firejail --profile=firefox bashgpg --card-statusExpected behavior
I see details about my card.
Actual behavior
Behavior without a profile
What changed calling
LC_ALL=C firejail --noprofile gpg --card-statusin a terminal?I see details about my card.
Additional context
I tried to noblacklist and whitelist GPG commands listed by
equery -C f app-crypt/gnupg. I added "ignore private-dev" to the local profile. I added 'ignore nou2f' suggested by keepassxc.profile (see also below).I can see devices in /dev/ in the firefox profile but all are owned by nobody:nobody. Host /dev/usb/hiddev[0-9] as well as /dev/hidraw[0-9] devices are crw------- 1 root:root. I guess that there needs to be additional file accessible to the user.
Environment
Checklist
/usr/bin/vlc) "fixes" it). I can operate GPG card outside the sandbox.https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers. DRM is irrelevant in this case. I am trying to make a PGP card running not u2f, so that is also irrelevant but to be safe, I tried adding "ignore nou2f" as mentioned above.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages) I am trying to access PGP card from Firefox, so I am trying firefox profile.Log
Output of
LC_ALL=C firejail gpg --card-status@rusty-snake commented on GitHub (Feb 28, 2022):
That because of
noroot.@polcak commented on GitHub (Feb 28, 2022):
Thanks for the reply.
ignore norootmade /dev files having original owners but gpg still does not see the card.@polcak commented on GitHub (Feb 28, 2022):
My local changes to the profile:
@rusty-snake commented on GitHub (Feb 28, 2022):
Any reason to use
firefox.profilerather thenfirefox.local?Why all these unnecessary
read-onlyandblacklistcommands?I've no real idea but does it work if you add
ignore nogroups? Do you use systemd? Or an other init like OpenRC? If so with elogind or similar?@polcak commented on GitHub (Feb 28, 2022):
You mean, I should do
mv .config/firejail/firefox.profile .config/firejail/firefox.localand remove the include of the system profile. I did just that. I created the profile a long time ago and I do not remember why I used .config/firejail/firefox.profile instead of .config/firejail/firefox.local but I very likely misunderstood the docs or was not sure about the correct name and firefox.profile worked for me.read-only- safe programming,blacklistin the .gnupg directory to hide revocation keys, otherblacklistbecause the directories were hidden by the current profile.No change for gpg.
Do you use systemd? Or an other init like OpenRC? If so with elogind or similar?
OpenRC and elogind.
I simplified the config, so I am now with
cat .config/firejail/firefox.local:I also noticed, that gnupg updated last week but there is no card status in firejail for both =app-crypt/gnupg-2.2.32-r1 and =app-crypt/gnupg-2.2.33-r1.
@polcak commented on GitHub (Mar 4, 2022):
So I noticed that whitelist-run-common.inc despite its name disables a bunch of files and directories in /run. So when the include is commented out, I made GPG running. I am not sure what exactly is needed from /run, yet.
A question: Is there a configuration I can put to my firefox.local like:
ignore include whitelist-run-common.inc
Thanks
@ghost commented on GitHub (Mar 4, 2022):
That's indeed the correct syntax.
IMO you can keep whitelist-run-common.inc but you need to add a few things to your firefox.local:
Side-note. Our firefox.profile indeed has
blacklist /usr/libexec. To undo that you're correct in addingnoblacklist /usr/libexec. A basic profile rule is that you don't need to noblacklist paths that are never blacklisted anywhere, it has no effect whatsoever to do that. Same rationale for /usr/sbin. That one is blacklisted in disable-common.inc so you need the onenoblacklist /usr/sbin. The rest you can safely drop:Maybe that's what @rusty-snake was hinting at above. We might want to create something like
allow-gpg.inccontaining what's needed for PGP cards. That would ease the burden on users, instead of them having to figure this out on their own.@rusty-snake commented on GitHub (Mar 4, 2022):
Non of them are affected by wrc. But probably makes sense anyway to add them.
It's always difficult because of whitelisting, private-bin, ...
But we can add it with
noblacklistcommands and a comment what else might be necessary.That's what's the name says ;)
@rusty-snake commented on GitHub (Mar 4, 2022):
@polcak What does
ls -la /runshow?@ghost commented on GitHub (Mar 4, 2022):
@rusty-snake All good arguments and ideas. I've added a few notes to my firejail-todo.md about 'allow-gpg.inc'. But in all honesty it's not high up, most of all because I don't have a yubikey or similar hw to do proper testing. Apologies to @polcak for side-tracking the issue.
@polcak commented on GitHub (Mar 7, 2022):
@ rusty-snake:
ls -la /runshows just a couple of directories withoutignore include whitelist-run-common.inc. When I do not includewhitelist-run-common.inc, run is much more populated (very likely the original /run). That is (for me) confusing.I went back to using only
So I removed:
When I use:
and
whitelist-run-common.incactivated, I get:The directory exists but cannot be accessed because it is owned by root:root (readable by root, no other permissions).
If I include
ignore include whitelist-run-common.inc, the GPG card works.@glitsj16: I do not feel like the issue is side-tracked. The main issue is likely similar to users are confused how to enable GPG card in a built-in profile.
@rusty-snake commented on GitHub (Mar 7, 2022):
I meant outside the sandbox, can you post? Some of them will need a
whitelist /run/foobar. Or you testfor file in /run/.* /run/*; do echo "whitelist $file"; done > whitelist-run-full.incand remove whitelistst until you find all necessary ones.If you have no
whitelist /run/…at all, the only thing done in/runisblacklisting (i.e. enumeration of badness) but if you have at least onewhitelist /run/…(even if the file does not exists), you switch towhitelisting (i.e. enumeration of goodness) only path with an explicitwhitelistare visible/accessible (and/run/firejail,/run/user/$UID).@dptpirate commented on GitHub (Aug 3, 2022):
Signing/encrypting emails with a smartcard is also broken with claws mail. It used to work.
@danielkrajnik commented on GitHub (Jun 29, 2023):
I was also trying to solve this to no avail. Resorted to removing librewolf's profile altogether for now.
Does anyone know what may cause some directories to change owner from user to root/nobody? Adding
ignore norootdoesn't work. I assume that's what causes lack of access to GPG agent (/run/user/1000/gnupghas gpg sockets inaccessible) in firefox/librewolf. This breaks browserpass extension.I know that this has been discussed before, but has there ever been a solution? Here for example are described elaborate steps to make it work without explaining why - everyone's threat model is different so it would be good to have some explanation somewhere why
${RUNUSER}/gnupgis changed torootornobody.@danielkrajnik commented on GitHub (Jun 29, 2023):
@rusty-snake this doesn't appear to be correct - some directories change to root owner permissions instead of user (in firefox or librewolf profiles)
@rusty-snake commented on GitHub (Jun 30, 2023):
That's how blacklisting is implemented. The path is read-only bind-mounted over with a file of same type (dir, reg, sock, ...) that has
0xo000permissions and is owned by root.@danielkrajnik commented on GitHub (Jun 30, 2023):
thank you for explaining, that makes sense, but in that case I don't know why adding both whitelist and noblacklist options still causes that directory to be blacklisted (owned by root):
Is there anything else that may blacklist gnupg? I've been grepping through all files in
/etc/firejailand nothing seemed to affect this directory directly.@felix-walter commented on GitHub (Dec 7, 2023):
Just stumbled upon this and found the following option in the Manpage of
firejail.profile:Adding this option to the profile solves it for me.
@mirko commented on GitHub (Jun 25, 2024):
This helped a lot so far and gpg can now access my SmartCard (YubiKey) when firejail'ed.
However the wrapper(-script) can not. Only
gpgin$PATHappears to can.Content of
/opt/wrappers/gpg:gpg --homedir ${HOME}/.mozilla/firefox/browserpass/gnupg-homedir --card-statusworks btw, so it's the wrapper script. I was thinking about AppArmor profiles, but didn't find anything.