mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #5137] dnsmasq: libvirtd cannot start NAT interface: PATH environment variable not set #2890
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2890
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @rsramkis on GitHub (May 9, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5137
Description
The default libvirt NAT network fails to start (even after applying the dnsmasq.profile which was in fix 5089.
Appears to be related to:
https://github.com/netblue30/firejail/issues/5089
Steps to Reproduce
https://github.com/netblue30/firejail/blob/master/etc/profile-a-l/dnsmasq.profile
Expected behavior
Actual behavior
The NAT Network interface fails to go active when firejail is enabled.
Environment
Linux info:
firejail --version
Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)EDIT by @rusty-snake: Fix check-boxes
@rsramkis commented on GitHub (May 15, 2022):
Is there anything else I should get for you to help troubleshoot the cause of the issue?
@rusty-snake commented on GitHub (May 15, 2022):
Try to comment dnsmasq.profile line for line to find more.
@rsramkis commented on GitHub (May 16, 2022):
Hi Rusty-snake,
I'll need more guidance on what you would like me to comment out in the dnsmasq.profile.
I ran the command:
I then grabbed the follow debug:
LC_ALL=C firejail --debug /usr/bin/dnsmasq
(See attachment)
firejail-dnsmasq-debug.txt
@rusty-snake commented on GitHub (May 16, 2022):
sudo virsh ...works as expected.sudo virsh ...works.@rsramkis commented on GitHub (May 17, 2022):
I did some testing today which leads me to believe the dnsmasq.profile is not causing the issue.
Test 1 - Firejail enabled, dnsmask.profile renamed to dnsmask.profile.old
(a) Firejail is enabled (sudo fircfg).
(b) Rename dnsmask.profile renamed to dnsmask.profile.old.
(c) Reboot Computer.
(d) Login. From Terminal run the following command to check the virtual Network status:
Test 2 - Disable Firejail and verify Virtual Network Starts (active):
(a) Disable Firejail (sudo firecfg --clean).
(b) Reboot Computer and login to system.
(c) From Terminal run the following command to check the network status.
I am assuming here that renaming the profile to dnsmask.profile.old means it is not loaded at all.
I also confirmed the ~/.config/firejail only has the file steam.profile in it.
@rusty-snake commented on GitHub (May 17, 2022):
If there is no dnsmasq.profile, server.profile(root)/default.profile(non-root) is used. You can create an empty dnsmasq.profile not load anything. (I assume the dnsmas(q|m) typo is only in you post).
~/.config/firejailof which user? If virsh starts dnsmasq as root, firejail will look into/root/.config/firejailand if it starts dnsmasq as virsh-dnsmasq-user firejail will try this home dir.@rsramkis commented on GitHub (May 18, 2022):
My post above I spelled dnsmasq.profile wrong. Here the command showing that I have the correct name.
I used the su command to sign in as root. Then I went to the ~/root/.config directory and saw no ~/home/.config/firejail.
I see a server.profile in the /etc/firejail directory. I will rename this server.profile.org and re-test.
@rsramkis commented on GitHub (May 18, 2022):
I re-tested by renaming the server.profile to server.profile.org and still the virtual network failed to start when firejail was enabled. Below is the flow of the test:
@rusty-snake commented on GitHub (May 19, 2022):
@rsramkis commented on GitHub (May 19, 2022):
So I went ahead and made to blank files for the profiles:
I rebooted the system and still the same error:
As you requested I did check the dnsmasq.service but it is not started (with firejail enabled\disabled).
I was reading on the Arch Wiki (https://wiki.archlinux.org/title/Libvirt )that libvirt utililizes dnsmasq as part of its virtual network.
Specifically:
I also checked the /etc/dnsmasq.conf file and everything was commented out. So I'm not sure what the next step is as I cannot prove how\when\who the dnsmasq.service is started.
@rusty-snake commented on GitHub (May 19, 2022):
Where did I? How does dnsmasq.service relate here?
Note: libvirtd starts it's own instance of dnsmasq.
Is never read by the libvirtd dnsmasq instance.
See
--conf-file=/var/lib/libvirt/...in your logs.See above.
@rsramkis commented on GitHub (May 19, 2022):
I am not sure how to check who is starting dnsmasq?
When I go to /var/lib/libvirt/dnsmasq I do see the default.conf.
@rsramkis commented on GitHub (May 19, 2022):
I decided to do a little circle back and check the journals. So on boot you can see when the error occur hwne trying to enable the virtual network:
With Firejail Disabled:
With Firejail Enabled:
@rusty-snake commented on GitHub (May 20, 2022):
Start it successful (w/o firejail) and use something like
ps -f -C dnsmasq.@rsramkis commented on GitHub (May 20, 2022):
When I first boot with firejail disabled and no VM started this is what is running:
I did start a virtual machine after to confirm I had network connectivity. There was no additional PID added.
@rusty-snake commented on GitHub (May 20, 2022):
If you look for
dnsmasqinps -f -H, how does it look like??
You can use
sudo firemonto see who(/when/...) starts a firejail sandbox.Why is it not set?
@rsramkis commented on GitHub (May 20, 2022):
Looks like this when firejail is disabled.
Is it possible that firejail is not allowing access to "/var/lib/libvirt/dnsmasq/default.conf "?
So are the correct steps:
(a) Enable Firejail.
(b) Open Terminal and start firemon (sudo firemon).
(c) Then in separate terminal try to start the virtual network with "sudo virsh net-start default".
@rusty-snake commented on GitHub (May 20, 2022):
What has this to do with that?
Summary of the problem so far:
=> Check you system configuration to make sure $PATH is set.
@rsramkis commented on GitHub (May 20, 2022):
This is the PATH I have set:
❯ echo $PATH
/home/user/.nvm/versions/node/v16.15.0/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/var/lib/flatpak/exports/bin:/usr/lib/jvm/default/bin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perl:/usr/lib/jvm/default/bin:/usr/lib/jvm/default/bi
Then I ran which:
I am guessing here (I don't know the ins and outs of firejail). So should I be adding to the dnsmasq.profile the following lines:
@rusty-snake commented on GitHub (May 20, 2022):
Is your terminal, but this does not matter because libvirtd/dnsmasq/firejail is not running as a child of this shell.
No, you don't need to do anything with firejail profiles.
This is not a firejail issues, it is a issues with you configuration of the part which starts dnsmasq/libvirtd.
@rsramkis commented on GitHub (May 20, 2022):
So lets put aside that with firejail disabled I can stop and start the NAT service with:
Are you suggesting I add something to the PATH or modify a configuration file? I can test whatever you suggest.
@rusty-snake commented on GitHub (May 20, 2022):
How is libvirtd started? By systemd? If so make sure it is started with a minimal $PATH (e.g.
/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin).This assumes dnsmasq is started by libvirtd via fork-exec.
@rsramkis commented on GitHub (May 20, 2022):
I do have the libvirtd.service enabled in systemd. I used the suggested configuration here:
https://wiki.archlinux.org/title/Libvirt
When I have firejail disabled this is what I see checking the service:
So everything is functional in the service. But when I enable firejail the service output changes to:
@rusty-snake commented on GitHub (May 20, 2022):
systemctl show-environment | grep PATH?@rsramkis commented on GitHub (May 20, 2022):
❯ systemctl show-environment | grep PATH
PATH=/usr/local/sbin:/usr/local/bin:/usr/bin
@rusty-snake commented on GitHub (May 20, 2022):
Ok, now I'm out of ideas.
Try to install a script in $PATH named
dnsmasqbefore any otherdnsmasq(so libvirtd will pick it) and use it to gather more information.@rsramkis commented on GitHub (May 20, 2022):
I know this was all working before as I had set up libvirtd on 01-10-2022, and firejail I have been running for maybe 3 years. But like usual libvirt changed in one of the upgrades and I assume the applications behaviour has changed. You would think other people would have reported this too (as defect 5089 was mentioned in the Arch forums).
As a temporary work around to get the NAT network working I can:
Disable Firejail.
Start the NAT service manually ( sudo virsh net-start default)
Then re-enable Firejail.
This allows the Virtual machines to have network access.
I'm all for following your plan of creating some sort of diagnostics script to gather information. My knowledge level is just not there on what I should write or what to look for.
So my next step will be digging more into the changes on libvirt (as I am just running a simple setup on my laptop) where I run the odd test vm.
If you have a test for me to run, please let me know and I will get it done.
@rusty-snake commented on GitHub (May 20, 2022):
Just remove dnsmasq from firecfg.config?
@rsramkis commented on GitHub (May 20, 2022):
One thing I am curious about is what is the difference between having an empty dnsmasq.profile vs commenting out dnsmasq in the firecfg file?
Additionally I did some checking for network listen ports. For dnsmasq to get port 53 you need to start it with root. But then I used ss and found this:
Trying to find dnsmasq in the listening ports found no results.
@rusty-snake commented on GitHub (May 20, 2022):
Is dnsmasq used as DNS server?
network-namespaces?
(The solution to your problem has nothing to do with any firejail profile)
@rsramkis commented on GitHub (May 23, 2022):
I've been doing some further research on this issue and found the two following threads on the issue:
virsh net-start default failes with PATH environment variable not set
https://gitlab.com/libvirt/libvirt/-/issues/282
[[SOLVED]Libvirt Virtual Network Start/Create Fails w/ PATH envvar...]
https://bbs.archlinux.org/viewtopic.php?id=274744
The bug seems to state that libvirtd calls dnsmasq from the $PATH now and not a hard coded value. This is something you had mentioned as we verified my PATH. My PATH does contain '/usr/bin', and yet libvirtd still reports it can't find dnsmasq. I hope the above links will assist you if you decide to reach out to libvirtd project to find out how the firejail dnsmasq.profile could be altered to support your product.
I'm going to close this bug with the work around of:
Thank you again for all of your assistance on troubleshooting the issue.
@ShellCode33 commented on GitHub (Nov 30, 2023):
I'm facing the same problem. Did you find a real fix @rsramkis ? I think this issue is worth being left open.
I don't know if this is relevant to this error but notice in the command line from the error that
--dhcp-script=/usr/lib/libvirt/libvirt_leaseshelperis used, but/usr/lib/libvirtdoesn't seem to be whitelisted in the dnsmasq profile.@rsramkis commented on GitHub (Dec 1, 2023):
After I shared my finding ... I did not investigate any further.
@marek22k commented on GitHub (Dec 10, 2023):
I have the same problem. Is there a solution in the meantime?
@ghost commented on GitHub (Dec 10, 2023):
There's persistent firecfg override functionality in git now. See my comment in #6121.