github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #5598] Profile with join-or-start option does not work with "--profile=" #3039

New issue
Open
opened 2026-05-05 09:41:06 -06:00 by gitea-mirror · 3 comments
gitea-mirror commented 2026-05-05 09:41:06 -06:00
Owner
Copy link

Originally created by @ferreum on GitHub (Jan 17, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5598

Description

When specifying a profile with --profile= option that contains join-or-start, firejail fails to join an existing sandbox and prints an error.
Starting the sandbox works. Only joining seems to be affected.

Steps to Reproduce

  1. Assume a minimal profile joinme.profile for testing, that only contains a join-or-start option:
> cat joinme.profile
join-or-start joinme
  1. In one terminal, run firejail with that profile:
> firejail --profile=joinme.profile sh
Reading profile joinme.profile
Parent pid 6936, child pid 6938
Child process initialized in 6.45 ms
sh-5.1$
  1. While the first sandbox is running, run the same command in a separate terminal:
> firejail --profile=joinme.profile sh
Reading profile joinme.profile
Switching to pid 6938, the first child process inside the sandbox
Changing root to /proc/6938/root
Error: --shell=none configured, but no program specified

Expected behavior

firejail joins the existing sandbox.

Actual behavior

firejail prints "Error: --shell=none configured, but no program specified" and exits.

Behavior without a profile

Joining without profile works:

> firejail --noprofile --join=joinme sh
Switching to pid 6938, the first child process inside the sandbox
Changing root to /proc/6938/root
Child process initialized in 2.47 ms
sh-5.1$ exit
> firejail --noprofile --join-or-start=joinme sh
Switching to pid 6938, the first child process inside the sandbox
Changing root to /proc/6938/root
Child process initialized in 3.27 ms
sh-5.1$

Additional context

Seems to be argument parsing related. Specifying --debug changes the error message (last line):

> firejail --debug --profile=joinme.profile sh
Reading profile joinme.profile
Switching to pid 6938, the first child process inside the sandbox
Changing root to /proc/6938/root
Set caps filter 1ffffffffff
Drop privileges: pid 4, uid 1000, gid 1000, force_nogroups 0
Error: invalid option --profile=joinme.profile after --join

That message makes no sense as there's no --join before --profile.

Environment

  • Linux distribution and version: Arch Linux
  • arch firejail pkg version 0.9.72-1
firejail version 0.9.72

Compile time support:
        - always force nonewprivs support is disabled
        - AppArmor support is enabled
        - AppImage support is enabled
        - chroot support is enabled
        - D-BUS proxy support is enabled
        - file transfer support is enabled
        - firetunnel support is disabled
        - IDS support is disabled
        - networking support is enabled
        - output logging is enabled
        - overlayfs support is disabled
        - private-home support is enabled
        - private-cache and tmpfs as user enabled
        - SELinux support is disabled
        - user namespace support is enabled
        - X11 sandboxing support is enabled

Checklist

  • The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
  • I can reproduce the issue without custom modifications (e.g. globals.local).
  • The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
  • The profile (and redirect profile if exists) hasn't already been fixed upstream.
  • I have performed a short search for similar issues (to avoid opening a duplicate).
    • I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
  • I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

See "Steps to Reproduce" and "Additional context" above.

Originally created by @ferreum on GitHub (Jan 17, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/5598 <!-- See the following links for help with formatting: https://guides.github.com/features/mastering-markdown/ https://docs.github.com/en/github/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax --> ### Description When specifying a profile with `--profile=` option that contains `join-or-start`, firejail fails to join an existing sandbox and prints an error. Starting the sandbox works. Only joining seems to be affected. ### Steps to Reproduce 1. Assume a minimal profile `joinme.profile` for testing, that only contains a `join-or-start` option: ``` > cat joinme.profile join-or-start joinme ``` 2. In one terminal, run firejail with that profile: ``` > firejail --profile=joinme.profile sh Reading profile joinme.profile Parent pid 6936, child pid 6938 Child process initialized in 6.45 ms sh-5.1$ ``` 3. While the first sandbox is running, run the same command in a separate terminal: ``` > firejail --profile=joinme.profile sh Reading profile joinme.profile Switching to pid 6938, the first child process inside the sandbox Changing root to /proc/6938/root Error: --shell=none configured, but no program specified ``` ### Expected behavior firejail joins the existing sandbox. ### Actual behavior firejail prints "Error: --shell=none configured, but no program specified" and exits. ### Behavior without a profile Joining without profile works: ``` > firejail --noprofile --join=joinme sh Switching to pid 6938, the first child process inside the sandbox Changing root to /proc/6938/root Child process initialized in 2.47 ms sh-5.1$ exit > firejail --noprofile --join-or-start=joinme sh Switching to pid 6938, the first child process inside the sandbox Changing root to /proc/6938/root Child process initialized in 3.27 ms sh-5.1$ ``` ### Additional context Seems to be argument parsing related. Specifying `--debug` changes the error message (last line): ``` > firejail --debug --profile=joinme.profile sh Reading profile joinme.profile Switching to pid 6938, the first child process inside the sandbox Changing root to /proc/6938/root Set caps filter 1ffffffffff Drop privileges: pid 4, uid 1000, gid 1000, force_nogroups 0 Error: invalid option --profile=joinme.profile after --join ``` That message makes no sense as there's no `--join` before `--profile`. ### Environment - Linux distribution and version: Arch Linux - arch firejail pkg version `0.9.72-1` ``` firejail version 0.9.72 Compile time support: - always force nonewprivs support is disabled - AppArmor support is enabled - AppImage support is enabled - chroot support is enabled - D-BUS proxy support is enabled - file transfer support is enabled - firetunnel support is disabled - IDS support is disabled - networking support is enabled - output logging is enabled - overlayfs support is disabled - private-home support is enabled - private-cache and tmpfs as user enabled - SELinux support is disabled - user namespace support is enabled - X11 sandboxing support is enabled ``` ### Checklist <!-- Note: Items are checked with an "x", like so: - [x] This is a checked item. --> - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [ ] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [ ] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [x] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log See "Steps to Reproduce" and "Additional context" above.
gitea-mirror added the
security
 label 2026-05-05 09:41:06 -06:00
gitea-mirror commented 2026-05-05 09:41:07 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jan 17, 2023):

Likely a regression from 4d79566ae3 and following.

<!-- gh-comment-id:1385790654 --> @rusty-snake commented on GitHub (Jan 17, 2023): Likely a regression from 4d79566ae3cef90700264f962837887a2d26fcf2 and following.
gitea-mirror commented 2026-05-05 09:41:10 -06:00
Author
Owner
Copy link

@ferreum commented on GitHub (Jan 18, 2023):

I found a way to trigger this without --profile= as well. Since this looks like a problem with argument parsing to me, I think it's the same issue.

The conditions are similar to above, but you need a profile containing join-or-start in the firejail profiles directory.

The invocation to join works in some cases, but if the program gets arguments starting with -- firejail gets confused:

  1. Assume a test profile echo.profile in the user's firejail path:
> cat ~/.config/firejail/echo.profile
join-or-start joinme
  1. Run the sandbox:
firejail --profile=:echo sh
Reading profile /home/me/.config/firejail/echo.profile
Parent pid 3361, child pid 3363
Child process initialized in 9.04 ms
sh-5.1$
  1. Try to join with echo:
firejail echo --a --b
Reading profile /home/me/.config/firejail/echo.profile
Switching to pid 3363, the first child process inside the sandbox
Changing root to /proc/3363/root
Error: invalid option --b after --join

firejail seems to get confused about which arguments belong to the sandboxed program. It reports --b as a problematic option, but that option is for echo, not for firejail.

The criteria to trigger this are strange:

  • it reports the second option, if two consecutive arguments starting with -- are encountered
  • leading arguments without -- are ignored (firejail echo a b c --a --b --c) reports --b
  • an argument starting with -- followed by one without works correctly (firejail echo --a x --b --c works)

This confusion about arguments seems similar to --debug changing the error message in the first report. In both cases the invocation works if the sandbox isn't already running.

<!-- gh-comment-id:1387505642 --> @ferreum commented on GitHub (Jan 18, 2023): I found a way to trigger this without `--profile=` as well. Since this looks like a problem with argument parsing to me, I think it's the same issue. The conditions are similar to above, but you need a profile containing `join-or-start` in the firejail profiles directory. The invocation to join works in some cases, but if the program gets arguments starting with `--` firejail gets confused: 1. Assume a test profile `echo.profile` in the user's firejail path: ``` > cat ~/.config/firejail/echo.profile join-or-start joinme ``` 2. Run the sandbox: ``` firejail --profile=:echo sh Reading profile /home/me/.config/firejail/echo.profile Parent pid 3361, child pid 3363 Child process initialized in 9.04 ms sh-5.1$ ``` 3. Try to join with echo: ``` firejail echo --a --b Reading profile /home/me/.config/firejail/echo.profile Switching to pid 3363, the first child process inside the sandbox Changing root to /proc/3363/root Error: invalid option --b after --join ``` firejail seems to get confused about which arguments belong to the sandboxed program. It reports `--b` as a problematic option, but that option is for echo, not for firejail. The criteria to trigger this are strange: - it reports the second option, if two consecutive arguments starting with `--` are encountered - leading arguments without `--` are ignored (`firejail echo a b c --a --b --c`) reports `--b` - an argument starting with `--` followed by one without works correctly (`firejail echo --a x --b --c` works) This confusion about arguments seems similar to `--debug` changing the error message in the first report. In both cases the invocation works if the sandbox isn't already running.
gitea-mirror commented 2026-05-05 09:41:11 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jan 18, 2023):

If firejail consfuses child arguments with its own arguments this sound like it could be a security vulnerability. Labeling as security for now.

Ping @netblue30 @smitsohu @topimiettinen @reinerh

<!-- gh-comment-id:1387636723 --> @rusty-snake commented on GitHub (Jan 18, 2023): If firejail consfuses child arguments with its own arguments this sound like it could be a security vulnerability. Labeling as security for now. Ping @netblue30 @smitsohu @topimiettinen @reinerh
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3039
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?