github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #5599] End-of-options indicator "--" leads to invalid shell invocation (fish shell) #3038

New issue
Closed
opened 2026-05-05 09:41:05 -06:00 by gitea-mirror · 8 comments
gitea-mirror commented 2026-05-05 09:41:05 -06:00
Owner
Copy link

Originally created by @ferreum on GitHub (Jan 17, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5599

Description

Separating the command from options with -- leads to an invalid shell invocation which leads to an error.

Steps to Reproduce

Run firejail with the command preceded by a -- argument:

> firejail --noprofile -- echo test
Parent pid 13724, child pid 13726
Child process initialized in 4.02 ms
fish: Unknown command: --
fish:
--
^

Parent is shutting down, bye...

Expected behavior

The command is run (echo) and "test" is printed.

Actual behavior

Firejail runs my shell (fish) and runs an invalid command through it.

Behavior without a profile

Happens with and without profile. Using --noprofile here for simplicity.

Additional context

Invoking without -- works as expected. The user's shell doesn't appear to be used in this case.
Setting the SHELL environment variable doesn't affect which shell is used. It's the user's shell from /etc/passwd.

Environment

  • Linux distribution and version: Arch Linux
  • arch firejail pkg version 0.9.72-1
firejail version 0.9.72

Compile time support:
        - always force nonewprivs support is disabled
        - AppArmor support is enabled
        - AppImage support is enabled
        - chroot support is enabled
        - D-BUS proxy support is enabled
        - file transfer support is enabled
        - firetunnel support is disabled
        - IDS support is disabled
        - networking support is enabled
        - output logging is enabled
        - overlayfs support is disabled
        - private-home support is enabled
        - private-cache and tmpfs as user enabled
        - SELinux support is disabled
        - user namespace support is enabled
        - X11 sandboxing support is enabled

Checklist

  • The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
  • I can reproduce the issue without custom modifications (e.g. globals.local).
  • The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
  • The profile (and redirect profile if exists) hasn't already been fixed upstream.
  • I have performed a short search for similar issues (to avoid opening a duplicate).
    • I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
  • I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail --debug --noprofile -- echo test 

Building quoted command line: 'echo' 'test'
Command name #echo#
DISPLAY=:0 parsed as 0
Using the local network stack
Initializing child process
Parent pid 14838, child pid 14840
Host network configured
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Creating empty /run/firejail/mnt/seccomp directory
Creating empty /run/firejail/mnt/seccomp/seccomp.protocol file
Creating empty /run/firejail/mnt/seccomp/seccomp.postexec file
Creating empty /run/firejail/mnt/seccomp/seccomp.postexec32 file
Mounting /proc filesystem representing the PID namespace
Basic read-only filesystem:
Mounting read-only /etc
2500 2460 254:0 /etc /etc ro,relatime master:1 - ext4 /dev/mapper/root rw
mountid=2500 fsname=/etc dir=/etc fstype=ext4
Mounting noexec /etc
2501 2500 254:0 /etc /etc ro,nosuid,nodev,noexec,relatime master:1 - ext4 /dev/mapper/root rw
mountid=2501 fsname=/etc dir=/etc fstype=ext4
Mounting read-only /var
2502 2460 254:0 /var /var ro,relatime master:1 - ext4 /dev/mapper/root rw
mountid=2502 fsname=/var dir=/var fstype=ext4
Mounting noexec /var
2503 2502 254:0 /var /var ro,nosuid,nodev,noexec,relatime master:1 - ext4 /dev/mapper/root rw
mountid=2503 fsname=/var dir=/var fstype=ext4
Mounting read-only /usr
2504 2460 254:0 /usr /usr ro,relatime master:1 - ext4 /dev/mapper/root rw
mountid=2504 fsname=/usr dir=/usr fstype=ext4
Mounting tmpfs on /var/lock
Mounting tmpfs on /var/tmp
Mounting tmpfs on /var/log
Create the new utmp file
Mount the new utmp file
Cleaning /home directory
Cleaning /run/user directory
Sanitizing /etc/passwd, UID_MIN 1000
Sanitizing /etc/group, GID_MIN 1000
Disable /home/me/.config/firejail
Disable /run/firejail/sandbox
Disable /run/firejail/network
Disable /run/firejail/bandwidth
Disable /run/firejail/name
Disable /run/firejail/profile
Disable /run/firejail/x11
blacklist /run/firejail/dbus
Mounting read-only /proc/sys
Remounting /sys directory
Disable /sys/firmware
Disable /sys/hypervisor
Disable /sys/power
Disable /sys/kernel/debug
Disable /sys/kernel/vmcoreinfo
Disable /proc/sys/fs/binfmt_misc
Disable /proc/sys/kernel/core_pattern
Disable /proc/sys/kernel/modprobe
Disable /proc/sysrq-trigger
Disable /proc/sys/vm/panic_on_oom
Disable /proc/irq
Disable /proc/bus
Disable /proc/timer_list
Disable /proc/kcore
Disable /proc/kallsyms
Disable /usr/lib/modules/6.1.6-arch1-1/build (requested /usr/src/linux)
Disable /usr/lib/modules (requested /lib/modules)
Disable /boot
Disable /dev/port
Disable /run/user/1000/gnupg
Disable /run/user/1000/systemd
Disable /dev/kmsg
Disable /proc/kmsg
Disable /sys/fs
Disable /sys/module
Current directory: /tmp/tmp.230117_1807-uqGZ
DISPLAY=:0 parsed as 0
Mounting read-only /run/firejail/mnt/seccomp
2545 2497 0:139 /seccomp /run/firejail/mnt/seccomp ro,nosuid - tmpfs tmpfs rw,mode=755,inode64
mountid=2545 fsname=/seccomp dir=/run/firejail/mnt/seccomp fstype=tmpfs
Seccomp directory:
ls /run/firejail/mnt/seccomp
drwxr-xr-x root     root             120 .
drwxr-xr-x root     root             160 ..
-rw-r--r-- me       me               640 seccomp
-rw-r--r-- me       me               432 seccomp.32
-rw-r--r-- me       me                 0 seccomp.postexec
-rw-r--r-- me       me                 0 seccomp.postexec32
No active seccomp files
Drop privileges: pid 1, uid 1000, gid 1000, force_nogroups 0
Closing non-standard file descriptors
Starting application
LD_PRELOAD=(null)
Running 'echo' 'test'  command through /usr/bin/fish
execvp argument 0: /usr/bin/fish
execvp argument 1: -c
execvp argument 2: --
execvp argument 3: 'echo' 'test'
Child process initialized in 7.58 ms
fish: Unknown command: --
fish:
--
^
monitoring pid 2

Sandbox monitor: waitpid 2 retval 2 status 32512

Parent is shutting down, bye...

Output of LC_ALL=C firejail --debug --noprofile echo test (working as expected) 

Building quoted command line: 'echo' 'test'
Command name #echo#
DISPLAY=:0 parsed as 0
Using the local network stack
Initializing child process
Parent pid 16420, child pid 16422
Host network configured
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Creating empty /run/firejail/mnt/seccomp directory
Creating empty /run/firejail/mnt/seccomp/seccomp.protocol file
Creating empty /run/firejail/mnt/seccomp/seccomp.postexec file
Creating empty /run/firejail/mnt/seccomp/seccomp.postexec32 file
Mounting /proc filesystem representing the PID namespace
Basic read-only filesystem:
Mounting read-only /etc
2500 2460 254:0 /etc /etc ro,relatime master:1 - ext4 /dev/mapper/root rw
mountid=2500 fsname=/etc dir=/etc fstype=ext4
Mounting noexec /etc
2501 2500 254:0 /etc /etc ro,nosuid,nodev,noexec,relatime master:1 - ext4 /dev/mapper/root rw
mountid=2501 fsname=/etc dir=/etc fstype=ext4
Mounting read-only /var
2502 2460 254:0 /var /var ro,relatime master:1 - ext4 /dev/mapper/root rw
mountid=2502 fsname=/var dir=/var fstype=ext4
Mounting noexec /var
2503 2502 254:0 /var /var ro,nosuid,nodev,noexec,relatime master:1 - ext4 /dev/mapper/root rw
mountid=2503 fsname=/var dir=/var fstype=ext4
Mounting read-only /usr
2504 2460 254:0 /usr /usr ro,relatime master:1 - ext4 /dev/mapper/root rw
mountid=2504 fsname=/usr dir=/usr fstype=ext4
Mounting tmpfs on /var/lock
Mounting tmpfs on /var/tmp
Mounting tmpfs on /var/log
Create the new utmp file
Mount the new utmp file
Cleaning /home directory
Cleaning /run/user directory
Sanitizing /etc/passwd, UID_MIN 1000
Sanitizing /etc/group, GID_MIN 1000
Disable /home/me/.config/firejail
Disable /run/firejail/sandbox
Disable /run/firejail/network
Disable /run/firejail/bandwidth
Disable /run/firejail/name
Disable /run/firejail/profile
Disable /run/firejail/x11
blacklist /run/firejail/dbus
Mounting read-only /proc/sys
Remounting /sys directory
Disable /sys/firmware
Disable /sys/hypervisor
Disable /sys/power
Disable /sys/kernel/debug
Disable /sys/kernel/vmcoreinfo
Disable /proc/sys/fs/binfmt_misc
Disable /proc/sys/kernel/core_pattern
Disable /proc/sys/kernel/modprobe
Disable /proc/sysrq-trigger
Disable /proc/sys/vm/panic_on_oom
Disable /proc/irq
Disable /proc/bus
Disable /proc/timer_list
Disable /proc/kcore
Disable /proc/kallsyms
Disable /usr/lib/modules/6.1.6-arch1-1/build (requested /usr/src/linux)
Disable /usr/lib/modules (requested /lib/modules)
Disable /boot
Disable /dev/port
Disable /run/user/1000/gnupg
Disable /run/user/1000/systemd
Disable /dev/kmsg
Disable /proc/kmsg
Disable /sys/fs
Disable /sys/module
Current directory: /tmp/tmp.230117_1807-uqGZ
DISPLAY=:0 parsed as 0
Mounting read-only /run/firejail/mnt/seccomp
2545 2497 0:139 /seccomp /run/firejail/mnt/seccomp ro,nosuid - tmpfs tmpfs rw,mode=755,inode64
mountid=2545 fsname=/seccomp dir=/run/firejail/mnt/seccomp fstype=tmpfs
Seccomp directory:
ls /run/firejail/mnt/seccomp
drwxr-xr-x root     root             120 .
drwxr-xr-x root     root             160 ..
-rw-r--r-- me       me               640 seccomp
-rw-r--r-- me       me               432 seccomp.32
-rw-r--r-- me       me                 0 seccomp.postexec
-rw-r--r-- me       me                 0 seccomp.postexec32
No active seccomp files
Drop privileges: pid 1, uid 1000, gid 1000, force_nogroups 0
Closing non-standard file descriptors
Starting application
LD_PRELOAD=(null)
execvp argument 0: echo
execvp argument 1: test
Child process initialized in 6.00 ms
Searching $PATH for echo
trying #/home/me/sbin/echo#
trying #/usr/local/sbin/echo#
trying #/usr/local/bin/echo#
trying #/usr/bin/echo#
test
monitoring pid 2

Sandbox monitor: waitpid 2 retval 2 status 0

Parent is shutting down, bye...

Originally created by @ferreum on GitHub (Jan 17, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/5599 <!-- See the following links for help with formatting: https://guides.github.com/features/mastering-markdown/ https://docs.github.com/en/github/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax --> ### Description Separating the command from options with `--` leads to an invalid shell invocation which leads to an error. ### Steps to Reproduce Run firejail with the command preceded by a `--` argument: ``` > firejail --noprofile -- echo test Parent pid 13724, child pid 13726 Child process initialized in 4.02 ms fish: Unknown command: -- fish: -- ^ Parent is shutting down, bye... ``` ### Expected behavior The command is run (echo) and "test" is printed. ### Actual behavior Firejail runs my shell (`fish`) and runs an invalid command through it. ### Behavior without a profile Happens with and without profile. Using `--noprofile` here for simplicity. ### Additional context Invoking without `--` works as expected. The user's shell doesn't appear to be used in this case. Setting the `SHELL` environment variable doesn't affect which shell is used. It's the user's shell from `/etc/passwd`. ### Environment - Linux distribution and version: Arch Linux - arch firejail pkg version 0.9.72-1 ``` firejail version 0.9.72 Compile time support: - always force nonewprivs support is disabled - AppArmor support is enabled - AppImage support is enabled - chroot support is enabled - D-BUS proxy support is enabled - file transfer support is enabled - firetunnel support is disabled - IDS support is disabled - networking support is enabled - output logging is enabled - overlayfs support is disabled - private-home support is enabled - private-cache and tmpfs as user enabled - SELinux support is disabled - user namespace support is enabled - X11 sandboxing support is enabled ``` ### Checklist <!-- Note: Items are checked with an "x", like so: - [x] This is a checked item. --> - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [ ] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [ ] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [x] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <details> <summary>Output of <code>LC_ALL=C firejail --debug --noprofile -- echo test</code></summary> <p> <!-- If the output is too long to embed it into the comment, create a secret gist at https://gist.github.com/ and link it here. --> ``` Building quoted command line: 'echo' 'test' Command name #echo# DISPLAY=:0 parsed as 0 Using the local network stack Initializing child process Parent pid 14838, child pid 14840 Host network configured PID namespace installed Mounting tmpfs on /run/firejail/mnt directory Creating empty /run/firejail/mnt/seccomp directory Creating empty /run/firejail/mnt/seccomp/seccomp.protocol file Creating empty /run/firejail/mnt/seccomp/seccomp.postexec file Creating empty /run/firejail/mnt/seccomp/seccomp.postexec32 file Mounting /proc filesystem representing the PID namespace Basic read-only filesystem: Mounting read-only /etc 2500 2460 254:0 /etc /etc ro,relatime master:1 - ext4 /dev/mapper/root rw mountid=2500 fsname=/etc dir=/etc fstype=ext4 Mounting noexec /etc 2501 2500 254:0 /etc /etc ro,nosuid,nodev,noexec,relatime master:1 - ext4 /dev/mapper/root rw mountid=2501 fsname=/etc dir=/etc fstype=ext4 Mounting read-only /var 2502 2460 254:0 /var /var ro,relatime master:1 - ext4 /dev/mapper/root rw mountid=2502 fsname=/var dir=/var fstype=ext4 Mounting noexec /var 2503 2502 254:0 /var /var ro,nosuid,nodev,noexec,relatime master:1 - ext4 /dev/mapper/root rw mountid=2503 fsname=/var dir=/var fstype=ext4 Mounting read-only /usr 2504 2460 254:0 /usr /usr ro,relatime master:1 - ext4 /dev/mapper/root rw mountid=2504 fsname=/usr dir=/usr fstype=ext4 Mounting tmpfs on /var/lock Mounting tmpfs on /var/tmp Mounting tmpfs on /var/log Create the new utmp file Mount the new utmp file Cleaning /home directory Cleaning /run/user directory Sanitizing /etc/passwd, UID_MIN 1000 Sanitizing /etc/group, GID_MIN 1000 Disable /home/me/.config/firejail Disable /run/firejail/sandbox Disable /run/firejail/network Disable /run/firejail/bandwidth Disable /run/firejail/name Disable /run/firejail/profile Disable /run/firejail/x11 blacklist /run/firejail/dbus Mounting read-only /proc/sys Remounting /sys directory Disable /sys/firmware Disable /sys/hypervisor Disable /sys/power Disable /sys/kernel/debug Disable /sys/kernel/vmcoreinfo Disable /proc/sys/fs/binfmt_misc Disable /proc/sys/kernel/core_pattern Disable /proc/sys/kernel/modprobe Disable /proc/sysrq-trigger Disable /proc/sys/vm/panic_on_oom Disable /proc/irq Disable /proc/bus Disable /proc/timer_list Disable /proc/kcore Disable /proc/kallsyms Disable /usr/lib/modules/6.1.6-arch1-1/build (requested /usr/src/linux) Disable /usr/lib/modules (requested /lib/modules) Disable /boot Disable /dev/port Disable /run/user/1000/gnupg Disable /run/user/1000/systemd Disable /dev/kmsg Disable /proc/kmsg Disable /sys/fs Disable /sys/module Current directory: /tmp/tmp.230117_1807-uqGZ DISPLAY=:0 parsed as 0 Mounting read-only /run/firejail/mnt/seccomp 2545 2497 0:139 /seccomp /run/firejail/mnt/seccomp ro,nosuid - tmpfs tmpfs rw,mode=755,inode64 mountid=2545 fsname=/seccomp dir=/run/firejail/mnt/seccomp fstype=tmpfs Seccomp directory: ls /run/firejail/mnt/seccomp drwxr-xr-x root root 120 . drwxr-xr-x root root 160 .. -rw-r--r-- me me 640 seccomp -rw-r--r-- me me 432 seccomp.32 -rw-r--r-- me me 0 seccomp.postexec -rw-r--r-- me me 0 seccomp.postexec32 No active seccomp files Drop privileges: pid 1, uid 1000, gid 1000, force_nogroups 0 Closing non-standard file descriptors Starting application LD_PRELOAD=(null) Running 'echo' 'test' command through /usr/bin/fish execvp argument 0: /usr/bin/fish execvp argument 1: -c execvp argument 2: -- execvp argument 3: 'echo' 'test' Child process initialized in 7.58 ms fish: Unknown command: -- fish: -- ^ monitoring pid 2 Sandbox monitor: waitpid 2 retval 2 status 32512 Parent is shutting down, bye... ``` </p> </details> <details> <summary>Output of <code>LC_ALL=C firejail --debug --noprofile echo test</code> (working as expected)</summary> <p> ``` Building quoted command line: 'echo' 'test' Command name #echo# DISPLAY=:0 parsed as 0 Using the local network stack Initializing child process Parent pid 16420, child pid 16422 Host network configured PID namespace installed Mounting tmpfs on /run/firejail/mnt directory Creating empty /run/firejail/mnt/seccomp directory Creating empty /run/firejail/mnt/seccomp/seccomp.protocol file Creating empty /run/firejail/mnt/seccomp/seccomp.postexec file Creating empty /run/firejail/mnt/seccomp/seccomp.postexec32 file Mounting /proc filesystem representing the PID namespace Basic read-only filesystem: Mounting read-only /etc 2500 2460 254:0 /etc /etc ro,relatime master:1 - ext4 /dev/mapper/root rw mountid=2500 fsname=/etc dir=/etc fstype=ext4 Mounting noexec /etc 2501 2500 254:0 /etc /etc ro,nosuid,nodev,noexec,relatime master:1 - ext4 /dev/mapper/root rw mountid=2501 fsname=/etc dir=/etc fstype=ext4 Mounting read-only /var 2502 2460 254:0 /var /var ro,relatime master:1 - ext4 /dev/mapper/root rw mountid=2502 fsname=/var dir=/var fstype=ext4 Mounting noexec /var 2503 2502 254:0 /var /var ro,nosuid,nodev,noexec,relatime master:1 - ext4 /dev/mapper/root rw mountid=2503 fsname=/var dir=/var fstype=ext4 Mounting read-only /usr 2504 2460 254:0 /usr /usr ro,relatime master:1 - ext4 /dev/mapper/root rw mountid=2504 fsname=/usr dir=/usr fstype=ext4 Mounting tmpfs on /var/lock Mounting tmpfs on /var/tmp Mounting tmpfs on /var/log Create the new utmp file Mount the new utmp file Cleaning /home directory Cleaning /run/user directory Sanitizing /etc/passwd, UID_MIN 1000 Sanitizing /etc/group, GID_MIN 1000 Disable /home/me/.config/firejail Disable /run/firejail/sandbox Disable /run/firejail/network Disable /run/firejail/bandwidth Disable /run/firejail/name Disable /run/firejail/profile Disable /run/firejail/x11 blacklist /run/firejail/dbus Mounting read-only /proc/sys Remounting /sys directory Disable /sys/firmware Disable /sys/hypervisor Disable /sys/power Disable /sys/kernel/debug Disable /sys/kernel/vmcoreinfo Disable /proc/sys/fs/binfmt_misc Disable /proc/sys/kernel/core_pattern Disable /proc/sys/kernel/modprobe Disable /proc/sysrq-trigger Disable /proc/sys/vm/panic_on_oom Disable /proc/irq Disable /proc/bus Disable /proc/timer_list Disable /proc/kcore Disable /proc/kallsyms Disable /usr/lib/modules/6.1.6-arch1-1/build (requested /usr/src/linux) Disable /usr/lib/modules (requested /lib/modules) Disable /boot Disable /dev/port Disable /run/user/1000/gnupg Disable /run/user/1000/systemd Disable /dev/kmsg Disable /proc/kmsg Disable /sys/fs Disable /sys/module Current directory: /tmp/tmp.230117_1807-uqGZ DISPLAY=:0 parsed as 0 Mounting read-only /run/firejail/mnt/seccomp 2545 2497 0:139 /seccomp /run/firejail/mnt/seccomp ro,nosuid - tmpfs tmpfs rw,mode=755,inode64 mountid=2545 fsname=/seccomp dir=/run/firejail/mnt/seccomp fstype=tmpfs Seccomp directory: ls /run/firejail/mnt/seccomp drwxr-xr-x root root 120 . drwxr-xr-x root root 160 .. -rw-r--r-- me me 640 seccomp -rw-r--r-- me me 432 seccomp.32 -rw-r--r-- me me 0 seccomp.postexec -rw-r--r-- me me 0 seccomp.postexec32 No active seccomp files Drop privileges: pid 1, uid 1000, gid 1000, force_nogroups 0 Closing non-standard file descriptors Starting application LD_PRELOAD=(null) execvp argument 0: echo execvp argument 1: test Child process initialized in 6.00 ms Searching $PATH for echo trying #/home/me/sbin/echo# trying #/usr/local/sbin/echo# trying #/usr/local/bin/echo# trying #/usr/bin/echo# test monitoring pid 2 Sandbox monitor: waitpid 2 retval 2 status 0 Parent is shutting down, bye... ``` </p> </details>
gitea-mirror 2026-05-05 09:41:05 -06:00
  • closed this issue
  • added the
    bug
         label
gitea-mirror commented 2026-05-05 09:41:08 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jan 17, 2023):

For reference: #5445, #3434

<!-- gh-comment-id:1385964688 --> @rusty-snake commented on GitHub (Jan 17, 2023): For reference: #5445, #3434
gitea-mirror commented 2026-05-05 09:41:10 -06:00
Author
Owner
Copy link

@kmk3 commented on GitHub (Jan 17, 2023):

I was thinking that this could be caused by #5190 ("shell none set as
default"), but the behavior appears to be the same on both 0.9.70 and 0.9.72:

$ firejail --debug --noprofile -- echo test 2>&1 |
  grep -e execvp -e test
Building quoted command line: 'echo' 'test'
Building quoted command line: 'echo' 'test'
Running 'echo' 'test'  command through /bin/bash
execvp argument 0: /bin/bash
execvp argument 1: -c
execvp argument 2: --
execvp argument 3: 'echo' 'test'
test
<!-- gh-comment-id:1385965019 --> @kmk3 commented on GitHub (Jan 17, 2023): I was thinking that this could be caused by #5190 ("shell none set as default"), but the behavior appears to be the same on both 0.9.70 and 0.9.72: ```console $ firejail --debug --noprofile -- echo test 2>&1 | grep -e execvp -e test Building quoted command line: 'echo' 'test' Building quoted command line: 'echo' 'test' Running 'echo' 'test' command through /bin/bash execvp argument 0: /bin/bash execvp argument 1: -c execvp argument 2: -- execvp argument 3: 'echo' 'test' test ```
gitea-mirror commented 2026-05-05 09:41:11 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jan 17, 2023):

Running 'echo' 'test' command through /usr/bin/fish
execvp argument 0: /usr/bin/fish

It should not even do this in 0.9.72 unless explicitly requested.

<!-- gh-comment-id:1385968520 --> @rusty-snake commented on GitHub (Jan 17, 2023): > Running 'echo' 'test' command through /usr/bin/fish > execvp argument 0: /usr/bin/fish It should not even do this in 0.9.72 unless explicitly requested.
gitea-mirror commented 2026-05-05 09:41:12 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jan 17, 2023):

My first analysis from reading older issues and the debug log from above: known bug with incomplete fix.

<!-- gh-comment-id:1385973841 --> @rusty-snake commented on GitHub (Jan 17, 2023): My first analysis from reading older issues and the debug log from above: known bug with incomplete fix.
gitea-mirror commented 2026-05-05 09:41:13 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jan 19, 2023):

Reopening because we still don't know why firejail starts a shell at all.

<!-- gh-comment-id:1397130605 --> @rusty-snake commented on GitHub (Jan 19, 2023): Reopening because we still don't know why firejail starts a shell at all.
gitea-mirror commented 2026-05-05 09:41:13 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jan 19, 2023):

Could be related to #5598.

<!-- gh-comment-id:1397131765 --> @rusty-snake commented on GitHub (Jan 19, 2023): Could be related to #5598.
gitea-mirror commented 2026-05-05 09:41:14 -06:00
Author
Owner
Copy link

@kmk3 commented on GitHub (Jan 19, 2023):

@rusty-snake on Jan 19:

Reopening because we still don't know why firejail starts a shell at all.

From my testing, the original problem as described was fixed on #5600, so
unless someone can still reproduce it, please avoid reopening the issue.

But feel free to open a dedicated discussion about why firejail spawns a shell
in this case (it is not clear to me either).

<!-- gh-comment-id:1397156854 --> @kmk3 commented on GitHub (Jan 19, 2023): @rusty-snake [on Jan 19](https://github.com/netblue30/firejail/issues/5599#issuecomment-1397130605): > Reopening because we still don't know why firejail starts a shell at all. From my testing, the original problem as described was fixed on #5600, so unless someone can still reproduce it, please avoid reopening the issue. But feel free to open a dedicated discussion about why firejail spawns a shell in this case (it is not clear to me either).
gitea-mirror commented 2026-05-05 09:41:15 -06:00
Author
Owner
Copy link

@paladox commented on GitHub (Dec 11, 2023):

Is there anyway a 0.9.72.1 release could be done please with this fix? And push to Debian (as bookworm uses 0.9.72)?

Using something like:

sudo -u www-data '/usr/bin/firejail' '--profile=/srv/mediawiki/w/includes/shell/firejail.profile' '--noroot' '--seccomp' '--private-dev' -- '/usr/bin/php' /srv/mediawiki/w/extensions/CreateWiki/maintenance/populateMainPage.php --wiki <wiki>

breaks with firejail "Cannot start application: Permission denied".

If I remove -- it works but I think this pull fixes it?

<!-- gh-comment-id:1850920879 --> @paladox commented on GitHub (Dec 11, 2023): Is there anyway a 0.9.72.1 release could be done please with this fix? And push to Debian (as bookworm uses 0.9.72)? Using something like: ``` sudo -u www-data '/usr/bin/firejail' '--profile=/srv/mediawiki/w/includes/shell/firejail.profile' '--noroot' '--seccomp' '--private-dev' -- '/usr/bin/php' /srv/mediawiki/w/extensions/CreateWiki/maintenance/populateMainPage.php --wiki <wiki> ``` breaks with firejail "Cannot start application: Permission denied". If I remove -- it works but I think this pull fixes it?
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3038
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?