mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #5023] [REOPEN] Element Messenger breaking out of Firejail? #2857
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2857
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @vsatmydynipnet on GitHub (Mar 7, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5023
Running
ii firejail 0.9.68-3 amd64 sandbox to restrict the application environment
ii firejail-profiles 0.9.68-3 all profiles for the firejail application sandbox
on Debian Sid.
I have running https://element.io Messenger and everything worked till the last update. Now I have the problem that if I want to save a file I only see the private home dir, but on upload I see the real home dir not
private /opt/Firejail/element
So it looks like Element breaks out on Upload from Firejail. Firefox and Thunderbird don't do that. These ones work.
Is there a way to debug things?
Running:
/usr/bin/firejail --profile=/home/user/.config/firejail/element.profile /bin/bash
has everythning correct.
Thank you for any hint.
@ghost commented on GitHub (Mar 7, 2022):
I'm assuming your
/home/user/.config/firejail/element.profileis for testing purposes only, correct? Just a question, I'm not so familiar with element and was confused to see it. The rest of your observations are based on using the app with the element-desktop.profile from /etc/firejail?@rusty-snake commented on GitHub (Mar 7, 2022):
Where do you see the real home? In the file open dialog? Does element use portals?
@vsatmydynipnet commented on GitHub (Mar 7, 2022):
Yes, with bash its for testing to see what is allowed. It normally starts Element. Using Bash and even more strange, also when saving files from Element everything is fine and I see the private home and only this one is accessible.
The real home is visible and accessible if I want to upload a file from local disk to Element.
I am sorry that I am no dev, so unsure how Element handles this, but it is an Electron Software as far as I know.
@kmk3 commented on GitHub (Mar 9, 2022):
@vsatmydynipnet commented on Mar 7:
The most obvious way that I know of to bypass the sandbox is through dbus.
Does it still happen if you add these to ~/.config/firejail/element.local?
@ghost commented on GitHub (Mar 9, 2022):
@kmk3 @vsatmydynipnet
Our current element-desktop.profile only allows user D-Bus to talk to org.freedesktop.secrets. It's worthwhile to check if the issue still shows with
dbus-user none, but IMO we need eyes on/home/user/.config/firejail/element.profiletoo so we can try to reproduce. There's only element-desktop.profile (including riot-{desktop,web}.profile) and that is confusing this discussion. @vsatmydynipnet Can you post that file please?@vsatmydynipnet commented on GitHub (Mar 9, 2022):
I tried
dbus-user none
dbus-system none
which does not help. I have put together all infos in the attachements. If you need more info, let me know.
Thank you for investigating the problem.
File Upload is a problem here:
Something went really wrong, and we can’t process that file.
I try with another comment.
@vsatmydynipnet commented on GitHub (Mar 9, 2022):
OK, Upload does not work. I copy the text info here, png upload does not work.....
SYSTEM INFO
@ghost commented on GitHub (Mar 9, 2022):
Okay, I've installed element-desktop on my machine for debugging this. I use Arch Linux, and that OS packages this app differently, not using /opt. So to replicate your setup as close as possible I downloaded this from the matrix repo, extracted and manually copied files into /opt/Element. I also created /opt/Firejail/element and dropped a few files in there. Did the same in /opt/Firejail/zzz just to be able to check if the
private /opt/Firejail/elementworks as it should or not. I'll come back to this in a moment. Using only ourelement-desktop.profilethe app starts fine here. After going through the account creation procedure I can login normally AFAICT (this is my first use of this app, so there's that to consider).TL;DR
With a proper element-desktop.local, I could upload and download to/from the matrix test-room. Even when adding a
private fooline. I couldn't break out of the sandbox to select files via the apps file explorer.Let me comment on parts of your element.profile. There are several lines that make no sense IMO, and they can be dropped without affecting any functionality or security aspect of the sandbox.
Firstly, paths that are never blacklisted anywhere don't need noblacklist'ing.
Secondly, I noticed is that you seem to be trying to allow opening links via chromium and firefox. At least that's what these lines suggest to me:
I can understand the why, but IMO it's not how to go about this.
Taking out these lines, I proceeded to test the
private foopart of this issue report.$ sudo chown -R foo:foo /opt/Firejail
The output is pretty straightforward and I wonder how your /opt/Firejail{,/element} do in this regard. Owned by your user, something else? We don't know.
At this moment I gave up on element.profile and created a element-desktop.local to check if I could break out of the sandbox, with and without including a
private foooption.With the above setup element-desktop seemed to be working nicely, including downloading/uploading etcetera. Settings persisted. Notifications worked. No trace of any sandbox escape by using the file explorer. I also tried your original
private /opt/Firejailafter ensuring correct ownerships on those dirs. That didn't work.I hope this can clarify some things for you. Feel free to ask, I'll keep the app installed for a while.
@vsatmydynipnet commented on GitHub (Mar 10, 2022):
Thank you for your work. I tried with your settings and when starting from cli I get this when trying to upload now:
Download would work as expected
@vsatmydynipnet commented on GitHub (Mar 10, 2022):
Based on your hints I found a solution:
Found this:
https://github.com/electron/electron/issues/31491
The Upstream issue:
https://bugs.chromium.org/p/chromium/issues/detail?id=1112159
and based on the Info that it worked I moved back Release by Release in
https://packages.riot.im/debian/pool/main/e/element-desktop/
Ended up with 1.10.3 and now all works again, with both of our profiles, but I definitely like yours more then mine.
Thank you so much for investigating here.
@rusty-snake commented on GitHub (Mar 10, 2022):
Can we close here?
@vsatmydynipnet commented on GitHub (Mar 10, 2022):
Forgot :-)
@vsatmydynipnet commented on GitHub (Apr 22, 2022):
Need to come back to this one here. After searching deeper, i found using
element-desktop --disable-gpu-sandbox removes the
[115:0310/101047.542845:ERROR:sandbox_linux.cc(377)] InitializeSandbox() called with multiple threads in process gpu-process.
error. But every version above 1.10.3
https://packages.riot.im/debian/pool/main/e/element-desktop/
shows the full home in the filesystem, where 1.10.3 only shows the private home. I have to add, that uploading of even allowed files fails with versions above 1.10.3. So in short 1.10.3 works fine, all above versions not.
I do not know the difference between 1.10.3 and higher versions.
Any hint would be greatly appreciated. I will post a link to this issue in element-desktop room on matrix too.
@vsatmydynipnet commented on GitHub (Jun 24, 2022):
Coming back to this problem I have the same problem using chromium under Debian Sid.
If i start the chromium profile using sh to check access:
/usr/bin/firejail --profile=/home/myuser/.config/firejail/chromium-KMJ.profile /bin/sh
i do see the private home as shown in the screenshot from mc. i do have no access to list the original folders of my home dir which also has mounted shares from truenas. At least i found no way to list any other homedirs except private home.
If i use chromium,
/usr/bin/firejail --profile=/home/myuser/.config/firejail/chromium-KMJ.profile /usr/bin/chromium --proxy-server=192.168.2.1:3128 %U
the same thing as with Element happens. Chromium is able to list all directories and files of the original homedir.
So chromium has a way to break out of firejail, accessing the original homedir except the private home set in the config.
I can not upload images here, so cant add the screenshots.
Edit:
NVIDIA Card installed
@vsatmydynipnet commented on GitHub (Jun 24, 2022):
edited above
@rusty-snake commented on GitHub (Jun 24, 2022):
OT: If you use uB in medium/hard mode or similar add-ons you need to allow
amazonaws.com.