github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #5539] audacity: network access and sandbox violation report #3025

New issue

Closed

opened 2026-05-05 09:40:36 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 09:40:36 -06:00

Owner

Originally created by @ghost on GitHub (Dec 20, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5539

During another round of testing for work on #5538 I noticed a few things about our current profile.

The app scans the system for available plugins, including /lib/modules (which is a hard-coded no-no). That throws a sandbox violation which might confuse users. Adding the allow-debuggers option can take care of this and AFAICT shouldn't negatively affect the security of the sandbox. Due to our restrictive private-bin audacity there wouldn't actually be active support for debuggers, just silencing the blacklist violation.

A more difficult decision to make is whether we grant network access to Audacity. Currently we do not, although there's an inconsistency in our profile which we should fix. After testing I can only see the app going out on the internet to download 2 extra plugins:

Besides using non-https URI's it's a bit of a pain to grant network access to an audio application for this sole purpose. There are plenty of built-in and installable (ladspa) filters/plugins already IMO. But that's an opinion nonetheless. Any thoughts on how we should proceed on this?

Originally created by @ghost on GitHub (Dec 20, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5539 During another round of testing for work on #5538 I noticed a few things about our current profile. The app scans the system for available plugins, including /lib/modules (which is a hard-coded no-no). That throws a `sandbox violation` which might confuse users. Adding the `allow-debuggers` option can take care of this and AFAICT shouldn't negatively affect the security of the sandbox. Due to our restrictive `private-bin audacity` there wouldn't actually be active support for debuggers, just silencing the blacklist violation. A more difficult decision to make is whether we grant `network access` to Audacity. Currently we do not, although there's an inconsistency in our profile which we should fix. After testing I can only see the app going out on the internet to download 2 extra plugins: - http://breakfastquay.com/rdf/lv2-rubberband#r3mono - http://breakfastquay.com/rdf/lv2-rubberband#r3stereo Besides using non-https URI's it's a bit of a pain to grant network access to an audio application for this sole purpose. There are plenty of built-in and installable (ladspa) filters/plugins already IMO. But that's an opinion nonetheless. Any thoughts on how we should proceed on this?

gitea-mirror closed this issue

2026-05-05 09:40:38 -06:00

gitea-mirror commented

2026-05-05 09:40:39 -06:00

Author

Owner

@netblue30 commented on GitHub (Dec 21, 2022):

Last year there were some discussions regarding the new privacy policy:

https://lifehacker.com/is-audacity-really-spyware-1847230028
https://www.pcmag.com/news/audacity-is-being-called-spyware-after-privacy-policy-update

Let's leave it the way you put it in 6e67801a45. If anybody needs live updates they can enable it in the profile.

@netblue30 commented on GitHub (Dec 21, 2022): Last year there were some discussions regarding the new privacy policy: https://lifehacker.com/is-audacity-really-spyware-1847230028 https://www.pcmag.com/news/audacity-is-being-called-spyware-after-privacy-policy-update Let's leave it the way you put it in https://github.com/netblue30/firejail/commit/6e67801a4592494d3d24e696f6fe06acc7856d88. If anybody needs live updates they can enable it in the profile.

gitea-mirror commented

2026-05-05 09:40:40 -06:00

Author

Owner

@ghost commented on GitHub (Dec 21, 2022):

@netblue30 Interesting info. Thanks for the heads-up!

@ghost commented on GitHub (Dec 21, 2022): @netblue30 Interesting info. Thanks for the heads-up!

gitea-mirror commented

2026-05-05 09:40:40 -06:00

Author

Owner

@kmk3 commented on GitHub (Aug 23, 2024):

The app scans the system for available plugins, including /lib/modules (which
is a hard-coded no-no). That throws a sandbox violation which might confuse
users. Adding the allow-debuggers option can take care of this and AFAICT
shouldn't negatively affect the security of the sandbox. Due to our
restrictive private-bin audacity there wouldn't actually be active support
for debuggers, just silencing the blacklist violation.

Is this still an issue?

A more difficult decision to make is whether we grant network access to
Audacity. Currently we do not, although there's an inconsistency in our
profile which we should fix. After testing I can only see the app going out
on the internet to download 2 extra plugins:

Networking is enabled by default in the profile now:

#6321

@kmk3 commented on GitHub (Aug 23, 2024): > The app scans the system for available plugins, including /lib/modules (which > is a hard-coded no-no). That throws a `sandbox violation` which might confuse > users. Adding the `allow-debuggers` option can take care of this and AFAICT > shouldn't negatively affect the security of the sandbox. Due to our > restrictive `private-bin audacity` there wouldn't actually be active support > for debuggers, just silencing the blacklist violation. Is this still an issue? > A more difficult decision to make is whether we grant `network access` to > Audacity. Currently we do not, although there's an inconsistency in our > profile which we should fix. After testing I can only see the app going out > on the internet to download 2 extra plugins: Networking is enabled by default in the profile now: * #6321

gitea-mirror commented

2026-05-05 09:40:41 -06:00

Author

Owner

@ghost commented on GitHub (Aug 23, 2024):

Is this still an issue?

No, the issue is fixed by #6321. Closing...

@ghost commented on GitHub (Aug 23, 2024): > Is this still an issue? No, the issue is fixed by #6321. Closing...

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3025

No description provided.

Rows
Columns