github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6430] Cannot use tap device with --net= #3271

New issue

Open

opened 2026-05-05 09:52:45 -06:00 by gitea-mirror · 8 comments

gitea-mirror commented

2026-05-05 09:52:45 -06:00

Owner

Originally created by @ghost on GitHub (Aug 2, 2024).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6430

firejail --private --net=ta0 --ip=192.168.5.2 firefox
Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/firefox-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-proc.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-run-common.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Parent pid 11856, child pid 11859

Interface        MAC                IP               Mask             Status
lo                                  127.0.0.1        255.0.0.0        UP    
eth0-11856       7e:31:a2:4a:0e:f5  192.168.5.2      255.255.255.0    DOWN

And the browser cannot use the proxy. But if I use:

firejail --private firefox

And input the same proxy settings again, it can use the proxy. 192.168.5.1 is the address of ta0 tap device.

Originally created by @ghost on GitHub (Aug 2, 2024). Original GitHub issue: https://github.com/netblue30/firejail/issues/6430 ~~~ firejail --private --net=ta0 --ip=192.168.5.2 firefox Reading profile /etc/firejail/firefox.profile Reading profile /etc/firejail/whitelist-usr-share-common.inc Reading profile /etc/firejail/firefox-common.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-proc.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-run-common.inc Reading profile /etc/firejail/whitelist-runuser-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Parent pid 11856, child pid 11859 Interface MAC IP Mask Status lo 127.0.0.1 255.0.0.0 UP eth0-11856 7e:31:a2:4a:0e:f5 192.168.5.2 255.255.255.0 DOWN ~~~ ![Screenshot_20240802_082623](https://github.com/user-attachments/assets/83966c46-63a0-4c45-9c6c-eb13179ccfc3) And the browser cannot use the proxy. But if I use: ~~~ firejail --private firefox ~~~ And input the same proxy settings again, it can use the proxy. 192.168.5.1 is the address of ta0 tap device.

gitea-mirror added the

networking

needinfo

labels 2026-05-05 09:52:45 -06:00

gitea-mirror commented

2026-05-05 09:52:47 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 2, 2024):

I do not get what you want. However it sounds XY to me. So can you rephrase it, start with the problem you want to solve and then your suggested fix.

@rusty-snake commented on GitHub (Aug 2, 2024): I do not get what you want. However it sounds XY to me. So can you rephrase it, start with the problem you want to solve and then your suggested fix.

gitea-mirror commented

2026-05-05 09:52:47 -06:00

Author

Owner

@ghost commented on GitHub (Aug 2, 2024):

Firejail will not try to configure the interface inside the sandbox. Besides --ip, you'll need to specify --netmask and --defaultgw. Have you tried that yet?

@ghost commented on GitHub (Aug 2, 2024): Firejail will not try to configure the interface inside the sandbox. Besides `--ip`, you'll need to specify `--netmask` and `--defaultgw`. Have you tried that yet?

gitea-mirror commented

2026-05-05 09:52:49 -06:00

Author

Owner

@ghost commented on GitHub (Aug 4, 2024):

I added a tap device using ip command

ip tuntap add t0 mode tap
ip a add 10.0.0.1/24 dev t0
ip link set t0 up
firejail --private --net=t0 --ip=10.0.0.2/24 --defaultgw=10.0.0.1 ping -c 3 10.0.0.1

Ping says missing cap_net_raw+p capability or setuid. @glitsj16 @rusty-snake

@ghost commented on GitHub (Aug 4, 2024): I added a tap device using ip command ~~~ ip tuntap add t0 mode tap ip a add 10.0.0.1/24 dev t0 ip link set t0 up firejail --private --net=t0 --ip=10.0.0.2/24 --defaultgw=10.0.0.1 ping -c 3 10.0.0.1 ~~~ Ping says missing cap_net_raw+p capability or setuid. @glitsj16 @rusty-snake

gitea-mirror commented

2026-05-05 09:52:50 -06:00

Author

Owner

@ghost commented on GitHub (Aug 4, 2024):

If your kernel allows unprivileged userns clone:

$ cat ~/.config/firejail/ping.local
include ping-hardened.inc.profile

Otherwise, you can try:

$ cat ~/.config/firejail/ping.local
caps.keep net_raw,setgid,setuid
ignore caps.keep

HTH

@ghost commented on GitHub (Aug 4, 2024): If your kernel allows `unprivileged userns clone`: ```sh $ cat ~/.config/firejail/ping.local include ping-hardened.inc.profile ``` Otherwise, you can try: ```sh $ cat ~/.config/firejail/ping.local caps.keep net_raw,setgid,setuid ignore caps.keep ``` HTH

gitea-mirror commented

2026-05-05 09:52:50 -06:00

Author

Owner

@ghost commented on GitHub (Aug 20, 2024):

If your kernel allows unprivileged userns clone:
$ cat ~/.config/firejail/ping.local
include ping-hardened.inc.profile
Otherwise, you can try:
$ cat ~/.config/firejail/ping.local
caps.keep net_raw,setgid,setuid
ignore caps.keep
HTH

What's the solution for web browsers?

@ghost commented on GitHub (Aug 20, 2024): > If your kernel allows `unprivileged userns clone`: > > ```shell > $ cat ~/.config/firejail/ping.local > include ping-hardened.inc.profile > ``` > > Otherwise, you can try: > > ```shell > $ cat ~/.config/firejail/ping.local > caps.keep net_raw,setgid,setuid > ignore caps.keep > ``` > > HTH What's the solution for web browsers?

gitea-mirror commented

2026-05-05 09:52:51 -06:00

Author

Owner

@ghost commented on GitHub (Aug 20, 2024):

What's the solution for web browsers?

If this needs the net_raw, setgid and setuid capabilities, you can apply similar 'logic' as above cfr. ping. firefox-common.profile drops all caps via caps.drop all, so an override would look like:

$ cat ~/.config/firejail/firefox.local
caps.keep net_raw,setgid,setuid
ignore caps.drop

@ghost commented on GitHub (Aug 20, 2024): > What's the solution for web browsers? If this needs the _net_raw_, _setgid_ and _setuid_ `capabilities`, you can apply similar 'logic' as above cfr. ping. firefox-common.profile drops all caps via `caps.drop all`, so an override would look like: ```sh $ cat ~/.config/firejail/firefox.local caps.keep net_raw,setgid,setuid ignore caps.drop ```

gitea-mirror commented

2026-05-05 09:52:51 -06:00

Author

Owner

@ghost commented on GitHub (Aug 24, 2024):

Will you let firejail automatically apply these settings for --net parameter?

@ghost commented on GitHub (Aug 24, 2024): Will you let firejail automatically apply these settings for --net parameter?

gitea-mirror commented

2026-05-05 09:52:52 -06:00

Author

Owner

@ghost commented on GitHub (Sep 26, 2024):

caps.keep net_raw,setgid,setuid
ignore caps.drop

Doesn't work on

Linux parabola 6.7.4-gnu-1 #1 SMP PREEMPT_DYNAMIC Thu, 08 Feb 2024 16:52:51 +0000 x86_64 GNU/Linux

Parabola is based on ArchLinux, so it may not work on Arch too.

@ghost commented on GitHub (Sep 26, 2024): > ```shell > caps.keep net_raw,setgid,setuid > ignore caps.drop > ``` Doesn't work on ~~~ Linux parabola 6.7.4-gnu-1 #1 SMP PREEMPT_DYNAMIC Thu, 08 Feb 2024 16:52:51 +0000 x86_64 GNU/Linux ~~~ Parabola is based on ArchLinux, so it may not work on Arch too.

gitea-mirror referenced this issue

2026-05-05 10:25:04 -06:00

[PR #3271] [MERGED] profiles: whitelist firefox/thunderbird default directories #4702

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3271

No description provided.

Rows
Columns