mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #5975] nautilus: cannot connect through sftp #3147
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#3147
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Alex-Farol on GitHub (Aug 26, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5975
Description
Nautilus can't connect to an sftp resource if firecfg is set.
Steps to Reproduce
Steps to reproduce the behavior
Expected behavior
To connect to the sftp location.
Actual behavior
With firecfg set, can't connect through sftp.
Behavior without a profile
Running firecfg --clean everything goes as expected
Additional context
The problem doesn't occour with smb connections
Environment
Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)Log
Output of
LC_ALL=C firejail /path/to/programOutput of
LC_ALL=C firejail --debug /path/to/program@kmk3 commented on GitHub (Aug 26, 2023):
That error message is not very informative.
If you open
nautilusfrom a terminal and try using sftp in it, what is theoutput in the terminal?
Does it work if you add the following to ~/.config/firejail/nautilus.local?
@Alex-Farol commented on GitHub (Aug 27, 2023):
That's the output:
Unfortunately, it didn't help.
Beyond that, looking for help on Gnome Discourse (before knowing the issue has been caused by firejail), it was suggested to take the output by using steps described on https://wiki.gnome.org/Projects/gvfs/debugging#Getting_debug_logs. That's what I get:
After that, someone said that everything's fine until:
sftp: stderr: unix_listener: cannot bind to path /run/user/1000/gvfsd-sftp/d726d0bea0333ba4154b9c8f9d5629c9e1cfac02.1VxB0A1nSK2fhIt2: No such file or directory@ghost commented on GitHub (Aug 28, 2023):
We still await your reply to @kmk3's suggestion to try
include allow-ssh.inc. Might also try withignore noexec ${RUNUSER}to see if that helps nautilus + gvfs(d)...@Alex-Farol commented on GitHub (Aug 31, 2023):
Hi again!
I'd already replied to @kmk3's suggestion. Unfortunately, it didn't work. Trying the
ignore noexec ${RUNUSER}also didn't help.Forgive-me for any typos, I'm not a native english speaker. :/
@ghost commented on GitHub (Sep 2, 2023):
Still clueless as to why nautilus borks on sftp. Personally I don't sandbox file managers and don't know Nautilus very well. Is your sftp/ssh firejailing working outside of Nautilus?
@Alex-Farol commented on GitHub (Sep 2, 2023):
Yes, it is!
@ghost commented on GitHub (Sep 2, 2023):
In that case I'm afraid I can only advise to take the slightly painfull road and try to comment out each line in
file-manager-common.profileto find the culprit...@rusty-snake commented on GitHub (Sep 3, 2023):
firemonwhile reproducing to find the program that get's startet.@Alex-Farol commented on GitHub (Sep 9, 2023):
Step 1: Verify that nautilus is not run inside firejail. I.e. a process started by nautilus has the problem.No, it doesn't.
@Alex-Farol commented on GitHub (Sep 9, 2023):
In that case I'm afraid I can only advise to take the slightly painfull road and try to comment out each line in file-manager-common.profile to find the culprit...I commented everything inside the file, but it didn't work.
@ghost commented on GitHub (Sep 10, 2023):
Tough nut to crack. Let's try something else.
032aa1ff1b/etc/profile-m-z/nautilus.profile (L9-L10)I think the above is what @rusty-snake was refering at in
Step 1. To make absolutely sure D-Bus activation isn't interfering/causing this somehow, place both of the below files in ~/.local/share/dbus1/services. They are drop-ins for the same files your OS should have under /usr/share/dbus-1/services, designed to intercept calls and help debugging. At the same time we run nautilus with the weakest possible firejail sandbox (noprofile.profile) to hopefully gain some details of what's happening.After a re-login, repeat what you always do nautilus-wise and if you get logs in your ~/Downloads directory, please post them here.
@Alex-Farol commented on GitHub (Sep 24, 2023):
Hi, @glitsj16!
I appreciate your help. Unfortunately, I did exactly as you suggested but the problem persists and no log file was created.
@phoenix-advance commented on GitHub (Sep 27, 2023):
Hello. What happens if you remove ssh from being firejailed? A bit crude but something like...
sudo rm /usr/local/bin/ssh... and then logout and then back in to test.
@Alex-Farol commented on GitHub (Oct 1, 2023):
@phoenix-advance, removing /usr/local/bin/ssh did the trick. Thanks for the fix!
Now I just would like to know if there can be any security implication after that.
@phoenix-advance commented on GitHub (Oct 2, 2023):
This definitely needs a proper fix. But I personally don't think removing ssh from doing
sudo firecfgwould be a big issue. If there's a security vulnerability with ssh, then there would be bigger fish to fry.@ghost commented on GitHub (Oct 2, 2023):
Depending on threat model and work-flow habits/preferences one can opt to disable SSH sandboxing. Far from ideal though. After going over this thread once again I wonder if
deterministic-shutdownin the ssh.profile is involved.References:
@Alex-Farol Can you test this? So ressurect the /usr/local/bin/ssh symlink and add
ignore deterministic-shutdownto your ssh.local.@Alex-Farol commented on GitHub (Oct 2, 2023):
My system didn't have a ssh.local file, so I created one and put that statement inside it. After bringing back the /usr/local/bin/ssh and testing Nautilus, the problem took place one more time.
@ghost commented on GitHub (Oct 3, 2023):
@Alex-Farol Thanks for testing. I have only one idea left:
HTH
@Alex-Farol commented on GitHub (Oct 4, 2023):
I tried with and without "ignore deterministic-shutdown", but none of them worked.
@ghost commented on GitHub (Oct 4, 2023):
@Alex-Farol Thanks a lot for testing. Sadly this all seems to confirm that the
nautilusSFTP functionality can't be properly sandboxed (as @phoenix-advance indicated). Personally I wouldn't feel comfortable disabling SSH sandboxing (by removing the /usr/local/bin/ssh symlink). Instead I would suggest using a dedicated app like FileZilla via firejail. It's always a pain to re-train muscle memory, but sometimes that's simply unavoidable...@phoenix-advance commented on GitHub (Oct 4, 2023):
@Alex-Farol Just one more test if you're keen...
@Alex-Farol commented on GitHub (Oct 19, 2023):
@phoenix-advance, it works!
@mirko commented on GitHub (Sep 14, 2024):
Changes which made it work for me:
include allow-ssh.incininclude allow-ssh.inc(changes Error from "Timeout" to "Connection failed")whitelist ${RUNUSER}/gvfsd-sftpinssh.local@kmk3 commented on GitHub (Sep 16, 2024):
Do you mean
include allow-ssh.incinnautilus.profile?@kmk3 commented on GitHub (Sep 16, 2024):
If the fix is the same as for #5816, then this is probably a duplicate.
Good catch.
@kmk3 commented on GitHub (Sep 16, 2024):
Duplicate of #5816