mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #5312] --netlock does not work (Error: no valid sandbox) #2955
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2955
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @distinctjuggle on GitHub (Aug 13, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5312
Description
Attempting to pass --netlock doesn't seem to be recognized by firejail - there is no terminal indication of it being present (as was demonstrated in the demo video for netlock's release), and I am able to access other networks that have not been connected to well after the default 1 minute timeout.
I also seem to get the following output in any command that I run which contains --netlock:
Error: no valid sandboxIt seemingly makes no difference as to which command is run, or if I include the --net option as specified as required for --netlock
It should also be noted that the error appears with a delay. For example, running
nanowill cause the error to appear inside of the text editor. Runninghtopwill cause the error to appear as new lines as the bottom of the screen. Running a command/program which has a longer startup will show up as a normal line of logs in a terminal.Steps to Reproduce
firejail --net=eth0 --netlock --noprofile *any command*firejail --netlock --noprofile *any command*firejail --netlock *any command*All of the above will still output the same error, and netlock's specific logs are not present anywhere
Expected behavior
I expected netlock to function
Actual behavior
Netlock did not function
Behavior without a profile
Profile has no bearing
Additional context
I'm just trying to limit a program to local network traffic only. This seemed like the easiest way that I could find, since I can control what this device tries to connect to within the first minute or so.
Environment
Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)Log
Output of
LC_ALL=C firejail /path/to/programNothing from firejail, unless I pass the --netlock option with or without --net=eth0 (then I get:
Error: no valid sandbox)Output of
LC_ALL=C firejail --debug /path/to/programNo errors other than the previously mentioned
Error: no valid sandboxwhen passing --netlock.I ran both firejail with no options, as well as with the options which cause the problem. Note that since
echois a short command, the relevant error shows up after the command has finished:Edit: Attempting to use any netfilter options also results in an error:
Error: invalid network filter file *filename*I've tried the default template configs as well as one that I made myself, none seem to work. Debug doesn't add any additional information or context.
@netblue30 commented on GitHub (Sep 26, 2022):
Thanks for the bug, something went wrong in the last release. Fixed on mainline!
@kmk3 commented on GitHub (Jan 11, 2023):
@netblue30 on Sep 26:
In that case, can this be closed?
I cannot reproduce the error with the following command:
@netblue30 commented on GitHub (Jan 12, 2023):
closing!