github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6018] firejail hangs trying to mount nfs-shares when offline #3158

New issue

Open

opened 2026-05-05 09:47:07 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 09:47:07 -06:00

Owner

Originally created by @kettenbruch on GitHub (Sep 23, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6018

Description

firejail tries to mount nfs directories, even when --net=none is supplied, causing it to hang on startup when the system is offline.

In my case, my system always has a nfs-shared pacman cache mounted at /var/cache/pacman/pkg,
on every invocation, firejail tries to mount that share for the sandbox as well, when the system is offline, firejail will hang until the system reconnects to the network.

Steps to Reproduce

mount the nfs share. mount -t nfs servername:/... /var/cache/pacman/pkg
diconnect the system from the network e.g. nmcli con down wlan0
run firejail any executable (profile=, net=, and the executable have no influence on this), e.g.
LC_ALL=C firejail --debug --net=none --noprofile /bin/bash

Expected behavior

let the mount fail, or provide an option to prevent firejail from mounting nfs shares / netdevs in general.

Actual behavior

firejail hangs without ever starting the executable, produces no output without supplying --debug (except for parent and child pids).

Behavior without a profile

Same behavior with and without profile (tested for bash).

Additional context

The device is a laptop and mounts the shared pacman cache at boot.
--blacklisting /var/cache/pacman/pkg has no effect on the mount at the filesystem level.
The various --private-xxx options don't exist forvar,

Is there a way to customize the mount procedure at startup that I have overlooked ?

Environment

Linux distribution: "Arch Linux"
firejail version 0.9.72

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
[N/A] The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail --debug /path/to/program

Building quoted command line: '/bin/bash'
Command name #bash#
DISPLAY=:0 parsed as 0
Parent pid 11145, child pid 11146
Initializing child process
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Creating empty /run/firejail/mnt/seccomp directory
Creating empty /run/firejail/mnt/seccomp/seccomp.protocol file
Creating empty /run/firejail/mnt/seccomp/seccomp.postexec file
Creating empty /run/firejail/mnt/seccomp/seccomp.postexec32 file
sbox run: /run/firejail/lib/fnet ifup lo
Set caps filter 3000
Network namespace enabled, only loopback interface available
Mounting /proc filesystem representing the PID namespace
Basic read-only filesystem:
Mounting read-only /etc
524 488 0:26 /@/etc /etc ro,noatime master:1 - btrfs /dev/sda2 rw,compress=zstd:3,ssd,discard=async,space_cache=v2,subvolid=678,subvol=/@
mountid=524 fsname=/@/etc dir=/etc fstype=btrfs
Mounting noexec /etc
525 524 0:26 /@/etc /etc ro,nosuid,nodev,noexec,noatime master:1 - btrfs /dev/sda2 rw,compress=zstd:3,ssd,discard=async,space_cache=v2,subvolid=678,subvol=/@
mountid=525 fsname=/@/etc dir=/etc fstype=btrfs
Mounting read-only /var
527 526 0:80 / /var/cache/pacman/pkg rw,nosuid,nodev,relatime master:227 - nfs4 ServerName:/path/to/pkg rw,vers=4.1,rsize=524288,wsize=524288,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,clientaddr=x.x.x.x,local_lock=none,addr=x.x.x.x
mountid=527 fsname=/ dir=/var/cache/pacman/pkg fstype=nfs4

Originally created by @kettenbruch on GitHub (Sep 23, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/6018 ### Description firejail tries to mount nfs directories, even when `--net=none` is supplied, causing it to hang on startup when the system is offline. In my case, my system always has a nfs-shared pacman cache mounted at /var/cache/pacman/pkg, on every invocation, firejail tries to mount that share for the sandbox as well, when the system is offline, firejail will hang until the system reconnects to the network. ### Steps to Reproduce 1. mount the nfs share. `mount -t nfs servername:/... /var/cache/pacman/pkg` 2. diconnect the system from the network e.g. `nmcli con down wlan0` 3. run firejail any executable (profile=, net=, and the executable have no influence on this), e.g. `LC_ALL=C firejail --debug --net=none --noprofile /bin/bash` ### Expected behavior let the mount fail, or provide an option to prevent firejail from mounting nfs shares / netdevs in general. ### Actual behavior firejail hangs without ever starting the executable, produces no output without supplying `--debug` (except for parent and child pids). ### Behavior without a profile Same behavior with and without profile (tested for bash). ### Additional context - The device is a laptop and mounts the shared pacman cache at boot. - `--blacklist`ing /var/cache/pacman/pkg has no effect on the mount at the filesystem level. - The various `--private-xxx` options don't exist for`var`, Is there a way to customize the mount procedure at startup that I have overlooked ? ### Environment - Linux distribution: "Arch Linux" - firejail version 0.9.72 ### Checklist - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [N/A] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log </p> </details> <details> <summary>Output of <code>LC_ALL=C firejail --debug /path/to/program</code></summary> <p> ``` Building quoted command line: '/bin/bash' Command name #bash# DISPLAY=:0 parsed as 0 Parent pid 11145, child pid 11146 Initializing child process PID namespace installed Mounting tmpfs on /run/firejail/mnt directory Creating empty /run/firejail/mnt/seccomp directory Creating empty /run/firejail/mnt/seccomp/seccomp.protocol file Creating empty /run/firejail/mnt/seccomp/seccomp.postexec file Creating empty /run/firejail/mnt/seccomp/seccomp.postexec32 file sbox run: /run/firejail/lib/fnet ifup lo Set caps filter 3000 Network namespace enabled, only loopback interface available Mounting /proc filesystem representing the PID namespace Basic read-only filesystem: Mounting read-only /etc 524 488 0:26 /@/etc /etc ro,noatime master:1 - btrfs /dev/sda2 rw,compress=zstd:3,ssd,discard=async,space_cache=v2,subvolid=678,subvol=/@ mountid=524 fsname=/@/etc dir=/etc fstype=btrfs Mounting noexec /etc 525 524 0:26 /@/etc /etc ro,nosuid,nodev,noexec,noatime master:1 - btrfs /dev/sda2 rw,compress=zstd:3,ssd,discard=async,space_cache=v2,subvolid=678,subvol=/@ mountid=525 fsname=/@/etc dir=/etc fstype=btrfs Mounting read-only /var 527 526 0:80 / /var/cache/pacman/pkg rw,nosuid,nodev,relatime master:227 - nfs4 ServerName:/path/to/pkg rw,vers=4.1,rsize=524288,wsize=524288,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,clientaddr=x.x.x.x,local_lock=none,addr=x.x.x.x mountid=527 fsname=/ dir=/var/cache/pacman/pkg fstype=nfs4 ``` </p> </details>

gitea-mirror added the

bug

networking

labels 2026-05-05 09:47:07 -06:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3158

No description provided.

Rows
Columns