mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #5676] kitty + ssh: Error: too long arguments: argv[22] len (5056) >= MAX_ARG_LEN (4128) #3059
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#3059
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @StandingPadAnimations on GitHub (Feb 21, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5676
Description
When using firejail with SSH, I receive the following error:
Steps to Reproduce
sudo firecfgExpected behavior
For SSH to not complain
Actual behavior
SSH not connecting due to too long arguments
Behavior without a profile
SSH was able to work perfectly fine
Additional context
Environment
Arch Linux
Firejail 0.9.72
Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)Log
Output of
LC_ALL=C firejail /path/to/programOutput of
LC_ALL=C firejail --debug /path/to/program@ghost commented on GitHub (Feb 21, 2023):
These are not the 'default' profiles that get installed to /etc/firejail. Without showing what's inside those two files there's nothing anyone can do to help.
@kmk3 commented on GitHub (Feb 21, 2023):
@StandingPadAnimations
Hello, with #5677 it should now print the offending argument (
argv[22]).Can you build firejail from #5677 and re-test it?
@StandingPadAnimations commented on GitHub (Feb 22, 2023):
Sorry about that, here you go:
@StandingPadAnimations commented on GitHub (Feb 23, 2023):
@kmk3 This is what I get
@ghost commented on GitHub (Feb 23, 2023):
No worries, that can happen. Thanks for showing it. I was mostly confused by seeing in your posted log output that ssh.profile was getting loaded from ~/.config/firejail (instead of /etc/firejail) but that the include files from it were not (at least I can't spot it in the log output). Additionally, the second one that does get included isn't a firejail project file at all:
Is that a custom file you created perhaps? I realize this isn't very helpful towards finding a (quick) fix for your issue. I'm just not clear on what's actually happening because of the lacking
common.incfile...@rusty-snake commented on GitHub (Feb 23, 2023):
Is it this
common.inc?@StandingPadAnimations commented on GitHub (Feb 23, 2023):
Here's the common.inc
@ghost commented on GitHub (Feb 24, 2023):
There are several conflicting options when you use the posted common.inc file in combination with our default profiles. Let me provide one example. SSH obviously needs network access, which is why there isn't
net nonein /etc/firejail/ssh.profile. By additionally including that common.inc (on the command line or from a shell script) that does havenet noneyour firejailed ssh will never work. Other potentially interfering options could be in play too (both private-tmp and noroot are known to break openssh). Instead of using this (outdated) common.inc I would suggest to make use of globals.local for any options you've tested not to break anything. And let firejail use its default profiles from /etc/firejail instead of replicating them under ~/.config/firejail. It will make debugging things for you much easier and generally keep the include logic as close to how it is designed/known to work.What happens when you temporarily move both files out of ~/.config/firejail (or rename them) and run
$ firejail --ignore=quiet /usr/bin/ssh?@kmk3 commented on GitHub (Feb 24, 2023):
@StandingPadAnimations on Feb 23:
Sorry, I referenced the wrong thing in my previous comment; by "#5676" I
meant "#5677" (the comment is fixed now).
Just to be clear, is this output from building and running from #5677?
If so, it looks like an entire shell script is being passed by argument (which
is rather unusual).
Edit: It mentions "kitty" and "ssh kitten"; are you trying to run kitty itself
firejailed or just ssh?
Anyway, please try what @glitsj16 said before re-running it.
@StandingPadAnimations commented on GitHub (Feb 24, 2023):
Kitty requires calling SSH with
kitty +kittensince without it, keypresses act weirdly: https://wiki.archlinux.org/title/Kitty#Terminal_issues_with_SSH@StandingPadAnimations commented on GitHub (Feb 24, 2023):
Yep
@StandingPadAnimations commented on GitHub (Feb 25, 2023):
Sorry for the late reply, it works fine as such:
But if I call
sshon it's own, the issue still persists. Interestingly enough though, if I call firejail manually with ssh (keep it mind it's aliased to prevent key-presses from being messed up), it works fine. It's only when I call ssh on its own where issues occur@ghost commented on GitHub (Feb 25, 2023):
Thanks for confirming the firejail profiles are fine. It looks like a kitty alias issue if I understand that correctly. On the Arch wiki page you linked earlier:
I would try changing that alias to
@StandingPadAnimations commented on GitHub (Feb 25, 2023):
I tried that but I still receive the error
@StandingPadAnimations commented on GitHub (Feb 25, 2023):
Ok looking into it further another error occurs:
Looks like setting the alias makes kitty very confused
@ghost commented on GitHub (Feb 25, 2023):
Not only kitty, I'm pretty confused by this as well :)
Have you tried some of the alternatives mentioned on the Arch wiki? Like here:
If that works for you there should no longer be any need for aliasing ssh via kitty +kitten voodoo...
@kmk3 commented on GitHub (Feb 25, 2023):
Ideally you should be able to execute ssh without kitty without issues, as
mentioned by @glitsj16.
If that does not work, considering the following constraints:
kitty +kitten sshfirejail /usr/bin/ssh)There should be a way to override the command line that gets executed when
trying to run a kitten.
That is, something like:
~/.config/kitty/ssh.conf
Though unforunately I don't see anything like that on its documentation.
So maybe try creating a wrapper for ssh and see if kitty calls that instead:
~/bin/ssh:
Then try again:
If none of that works, I'd suggest asking about this on the kitty project (and
referencing this issue).
@StandingPadAnimations commented on GitHub (Mar 1, 2023):
Looks like that works, and
firejail --listconfirms that indeed ssh runs in a sandbox, I'll just close this now------- Original Message -------
On Saturday, February 25th, 2023 at 10:23 PM, glitsj16 @.***> wrote:
@kmk3 commented on GitHub (Mar 1, 2023):
(Re-closing as "not planned" since nothing was changed in firejail)