mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #6379] ssh: cannot access private key stored in TPM (private-dev) #3256
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#3256
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @qdii on GitHub (Jun 13, 2024).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6379
Description
Security freaks like me do like to store their SSH private keys in protected places. Most laptops nowadays come with a TPM, which can store them (see https://jade.fyi/blog/tpm-ssh/ for instance).
Steps to Reproduce
Follow the configuration guide for ssh with TPM2 linked above
Add the following configuration in
ssh.localNote: the SSH connection is also broken without adding these lines, but for a different reasons (no access to
/dev/tpm0, no access to the libraries).Run
firejail ssh <some host>Expected behavior
A SSH connection is opened to the host.
Actual behavior
An error message appears and no connection is established.
Behavior without a profile
A SSH connection is established.
Environment
Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)Log
@rusty-snake commented on GitHub (Jun 13, 2024):
Instead of removing
private-devfrom profiles, we should enhanceprivate-dev.Proposal 1.
private-devincludes TPM devicesnotpmblocks themProposal 2.
private-devsupports subgroups.private-devonly basic devicesprivate-dev tpm,video,3dbasic with TPM devices, video devices and GPU.@ghost commented on GitHub (Jun 13, 2024):
@qdii
The
ssh.profilein 0.9.72 already hasprivate-dev, I don't get why you added it (once more) to yourssh.local. Unless you wanted toignore private-dev?@kmk3 commented on GitHub (Jun 13, 2024):
@rusty-snake on Jun 13:
Agreed.
That makes sense, though why not reuse
nou2ffor this?Aren't they used for the same use case?
Or is access to the tpm more critical than to u2f devices?
@ghost commented on GitHub (Jun 13, 2024):
@rusty-snake
That's the way forward, fully agree.
I like
Proposal 1.@kmk3 commented on GitHub (Jun 13, 2024):
@qdii on Jun 13:
When executing firejail directly, it's recommended to use the full path for the
program, to avoid calling firejail within firejail, as the program may already
be symlinked to firejail through firecfg (ssh -> /usr/local/bin/ssh ->
firejail).
For example:
@ghost commented on GitHub (Jun 13, 2024):
Side note:
The linked blog entree mentions
/etc/tpm2-tssand${HOME}/.tpm2_pkcs11. We might want to protect these directories.Sadly I don't have hardware with a TPM (for now) to actually check what OP can do to support their setup with the 0.9.72 ssh.profile.
@qdii commented on GitHub (Jun 13, 2024):
I'm happy to be your testing monkey :) Just throw a config at me and I'll try.
@rusty-snake commented on GitHub (Jun 13, 2024):
FWIW
@qdii commented on GitHub (Jun 15, 2024):
So far, my
ssh.locallooks like this:However I always get the same error:
I'm not sure why
fexecvefails like this?@rusty-snake commented on GitHub (Jun 15, 2024):
Guess ssh needs a few more libraries than
libtss2-*like libc, libpcre2, libselinux, ...@qdii commented on GitHub (Jun 16, 2024):
Inspired by this comment, I extended
ssh.localusing the result ofldd:Unfortunately this doesn't help much:
@rusty-snake commented on GitHub (Jun 16, 2024):
Looks like
/usr/lib*/firejailis missing.I wouldn't mess with whitelisting in
/usr/lib*@kmk3 commented on GitHub (Jun 17, 2024):
@qdii on Jun 13:
Note that whitelisting a path also enables whitelisting in its base directory,
so unless the profile already has similar whitelisting commands, adding them is
likely to just lead to more breakage.
What is the output without any local modifications?
Example:
Also, if you use
private-lib, make sure that it is not in effect.@qdii on Jun 16:
See
--trace=in the firejail manual, which is likely to be more helpful.@qdii commented on GitHub (Jun 17, 2024):
With no modification, SSH simply connects to the host:
If I understand correctly the previous comments, allowing libraries to be loaded is better done using
private-libthanwhitelist, so I modified myssh.localfile so that now it reads this:Then executing gives this:
@ghost commented on GitHub (Jun 17, 2024):
Be aware that
private-libis disabled by default in/etc/firejail/firejail.config:FYI: after
0.9.72things have changed even more and, besides the above, support for private-lib needs to be explicitly enabled during configure.So although technically on 0.9.72 you can use it, the option isn't actively supported any longer. If you use it, keep eyes on this option whenever a
0.9.74release hits your OS.@kmk3 commented on GitHub (Jun 18, 2024):
@qdii on Jun 17:
Modifying /usr/lib is rarely done and is likely not as tested, so unless you
know what you're doing and are able to debug and fix errors, I'd avoid doing
anything with /usr/lib in profiles.
As for the other entries, the whitelisting in
${HOME}is fine.Though in /etc it is usually done with
private-etc.Try this in ssh.local:
@qdii commented on GitHub (Jun 18, 2024):
Ok, thanks for the explanation about private-lib and modifying /usr/lib.
@ghost commented on GitHub (Jun 18, 2024):
Looks like you need more from /etc than is currently allowed. Try adding
group,login.defs,passwdtoprivate-etc:@qdii commented on GitHub (Jun 19, 2024):
OK I get a little further, but still no TPM
@qdii commented on GitHub (Jun 22, 2024):
@kmk3
I think U2F and TPMs share the same goal, but do not always come in the same form factor:
Binding the two in firejail would make it less flexible for the user to disable one without disabling the other, and currently now the source code relates U2F to USB devices: https://github.com/netblue30/firejail/blob/master/src/firejail/fs_dev.c#L92.
So I think distinguishing them is a better approach.
@kmk3 commented on GitHub (Jun 23, 2024):
@qdii on Jun 19:
Sorry, in the previous comment I left out the default paths for
private-etc,which are now included by default (and also modified IIRC) in 0.9.73 (see
#5610).
There have been many changes to
private-etc(among other things) since0.9.72, so please use firejail-git (AUR) in this issue to ensure
reproducibility.
Also, does it work without
private-etc?What is the output of the following commands?
What is the output in trace.txt and trace_local.txt?
@qdii commented on GitHub (Jun 23, 2024):
I actually don't see any difference in the output with or without
private-etc@qdii commented on GitHub (Jun 25, 2024):
@kmk3 commented on GitHub (Jul 4, 2024):
The original issue was about accessing the keys in the TPM, which should be
fixed by #6390.
As for issues arising from adding whitelisting, I'd suggest looking at the
output of
--trace=to see what other paths libtss tries to access in${HOME}and then try to whitelist those paths as well.The libtss error messages unfortunately do not contain any paths, but it looks
like it might need access to dbus as well, so maybe
ignore dbus-user nonecould help.
@qdii commented on GitHub (Jul 4, 2024):
True, the issue at hand is solved, I'll try with trace, and open another issue if it persists.