github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #5487] --private=dir can be bypassed without --dbus-user=filter (dbus) #3013

New issue

Closed

opened 2026-05-05 09:40:01 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 09:40:01 -06:00

Owner

Originally created by @blogdron on GitHub (Nov 27, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5487

Sorry I'm not very good at bug reporting and not sure if this is a bug or if I just don't understand something.

Description

Im download game from https://stacksengine.itch.io/stacks-space

I wish it didn't have access to the network and my files so I created a directory ~/Рабочий-стол/stgame and put it there, then I ran it like this.

1 $cd ~/Рабочий-стол/stgame
2 $firejail --noprofile --net=none --private=. ./stacks-space
Im press button in game open mod file for load json file from stgame directory. But game see all my files from / includes /home/dron its my home and /home/guest and ignore --private=pwd` option :(

If im run $ firejail --private=. --net=none --seccomp.drop=all ./stacks-space in game file dialog not opening with log

select_file_dialog_linux_portal.cc(716)] Portal returned error: org.freedesktop.DBus.Error.AccessDenied: Portal operation not allowed: Unable to open /proc/134310/root

I understand the program uses a loophole through the portal of the gnome

If im run $ firejail --private=. --net=none --profile=default ./stacks-space

Im have log

Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Warning: networking feature is disabled in Firejail configuration file
Parent pid 134694, child pid 134695
Child process initialized in 93.31 ms
Check failed: sys_chroot("/proc/self/fdinfo/") == 0

Parent is shutting down, bye...

game chrooting in /proc/131875/root for access to all system files and ignore --private=dir option.
It seems to me that the --private=dir option should work without additional keys that take into account the peculiarities of the programs. If I specified to change my home directory, then the program should not access the files. See picture
https://i.ibb.co/CMzF2QS/2022-11-27-17-52-48.png

file dialog running from game have access to all files, and ignore --private=. option

dron@gnu:~/Рабочий-стол/stgame$ firejail --version
firejail version 0.9.70

Compile time support:
	- always force nonewprivs support is disabled
	- AppArmor support is enabled
	- AppImage support is enabled
	- chroot support is enabled
	- D-BUS proxy support is enabled
	- file transfer support is enabled
	- firetunnel support is enabled
	- IDS support is enabled
	- networking support is enabled
	- output logging is enabled
	- overlayfs support is disabled
	- private-home support is enabled
	- private-cache and tmpfs as user enabled
	- SELinux support is enabled
	- user namespace support is enabled
	- X11 sandboxing support is enabled

 uname -a
Linux gnu 5.19.0-2-amd64 #1 SMP PREEMPT_DYNAMIC Debian 5.19.11-1 (2022-09-24) x86_64 GNU/Linux

Originally created by @blogdron on GitHub (Nov 27, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5487 **Sorry I'm not very good at bug reporting and not sure if this is a bug or if I just don't understand something.** ### Description Im download game from https://stacksengine.itch.io/stacks-space ----------- I wish it didn't have access to the network and my files so I created a directory `~/Рабочий-стол/stgame` and put it there, then I ran it like this. * 1 `$cd ~/Рабочий-стол/stgame` * 2 `$firejail --noprofile --net=none --private=. ./stacks-space` * Im press button in game **open mod file** for load json file from `stgame` directory. But game see all my files from `/` includes `/home/dron` its my home and `/home/guest` and ignore `--private=`pwd` option :( ------------ If im run `$ firejail --private=. --net=none --seccomp.drop=all ./stacks-space` in game file dialog not opening with log ```sh select_file_dialog_linux_portal.cc(716)] Portal returned error: org.freedesktop.DBus.Error.AccessDenied: Portal operation not allowed: Unable to open /proc/134310/root ``` I understand the program uses a loophole through the portal of the gnome ------------ If im run `$ firejail --private=. --net=none --profile=default ./stacks-space ` Im have log ```sh Reading profile /etc/firejail/default.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Warning: networking feature is disabled in Firejail configuration file Parent pid 134694, child pid 134695 Child process initialized in 93.31 ms Check failed: sys_chroot("/proc/self/fdinfo/") == 0 Parent is shutting down, bye... ``` game chrooting in ` /proc/131875/root` for access to all system files and **ignore** `--private=dir` option. It seems to me that the `--private=dir` option should work without additional keys that take into account the peculiarities of the programs. If I specified to change my home directory, then the program should not access the files. See picture https://i.ibb.co/CMzF2QS/2022-11-27-17-52-48.png ![img](https://i.ibb.co/CMzF2QS/2022-11-27-17-52-48.png) file dialog running from game have access to all files, and ignore `--private=.` option ----------- ```sh dron@gnu:~/Рабочий-стол/stgame$ firejail --version firejail version 0.9.70 Compile time support: - always force nonewprivs support is disabled - AppArmor support is enabled - AppImage support is enabled - chroot support is enabled - D-BUS proxy support is enabled - file transfer support is enabled - firetunnel support is enabled - IDS support is enabled - networking support is enabled - output logging is enabled - overlayfs support is disabled - private-home support is enabled - private-cache and tmpfs as user enabled - SELinux support is enabled - user namespace support is enabled - X11 sandboxing support is enabled ``` ``` uname -a Linux gnu 5.19.0-2-amd64 #1 SMP PREEMPT_DYNAMIC Debian 5.19.11-1 (2022-09-24) x86_64 GNU/Linux ```

gitea-mirror

2026-05-05 09:40:01 -06:00

closed this issue
added the
notabug
label

gitea-mirror commented

2026-05-05 09:40:04 -06:00

Author

Owner

@blogdron commented on GitHub (Nov 28, 2022):

Can anyone confirm this behavior on Chrome-based games/applications? Maybe this is normal behavior? Or not?

@blogdron commented on GitHub (Nov 28, 2022): Can anyone confirm this behavior on Chrome-based games/applications? Maybe this is normal behavior? Or not?

gitea-mirror commented

2026-05-05 09:40:04 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 28, 2022):

Known (and Expected) behaviour, see all the other issues.

FTR: Not a sandbox escape, "just" broken UX and functionality.

@rusty-snake commented on GitHub (Nov 28, 2022): Known (and Expected) behaviour, see all the other issues. FTR: Not a sandbox escape, "just" broken UX and functionality.

gitea-mirror commented

2026-05-05 09:40:05 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 28, 2022):

Also there's no all syscall and if you meant do run without any syscall it's impossible for a useful program.

@rusty-snake commented on GitHub (Nov 28, 2022): Also there's no `all` syscall and if you meant do run without any syscall it's impossible for a useful program.

gitea-mirror commented

2026-05-05 09:40:06 -06:00

Author

Owner

@blogdron commented on GitHub (Nov 29, 2022):

Known (and Expected) behaviour, see all the other issues.

FTR: Not a sandbox escape, "just" broken UX and functionality.

chromium and chrome They have the same behavior, but firefox does not!
Empirically found out that it is the envy of the option dbus-user=filter

If this option is set, then chromium-based applications behave correctly and the called external file dialog shows exactly what it is limited to.

Probably this dbus-user=filter option should be activated automatically if used --private or --private=dir. Maybe =)

@blogdron commented on GitHub (Nov 29, 2022): > Known (and Expected) behaviour, see all the other issues. > > FTR: Not a sandbox escape, "just" broken UX and functionality. chromium and chrome They have the same behavior, but firefox does not! Empirically found out that it is the envy of the option `dbus-user=filter` If this option is set, then chromium-based applications behave correctly and the called external file dialog shows exactly what it is limited to. Probably this `dbus-user=filter` option should be activated automatically if used `--private` or `--private=dir`. Maybe =)

gitea-mirror commented

2026-05-05 09:40:07 -06:00

Author

Owner

@kmk3 commented on GitHub (Aug 23, 2024):

Known (and Expected) behaviour, see all the other issues.

@kmk3 commented on GitHub (Aug 23, 2024): > Known (and Expected) behaviour, see all the other issues.

gitea-mirror referenced this issue

2026-05-05 10:23:23 -06:00

[PR #3014] [MERGED] profiles: waterfox: rework profile #4614

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3013

No description provided.

Rows
Columns