[GH-ISSUE #464] firejail detects existing sandbox in lxc

gitea-mirror commented

2026-05-05 05:36:53 -06:00

Owner

Originally created by @reinerh on GitHub (Apr 20, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/464

Hi netblue30.

You have a really impressive test suite in test/, which is awesome!
But it is not included in the release tarball.
I thought about letting these tests run automatically on Debian's CI infrastructure [1].
Could you please include the tests in your next release?

1: https://ci.debian.net/

Originally created by @reinerh on GitHub (Apr 20, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/464 Hi netblue30. You have a really impressive test suite in test/, which is awesome! But it is not included in the release tarball. I thought about letting these tests run automatically on Debian's CI infrastructure [1]. Could you please include the tests in your next release? 1: https://ci.debian.net/

gitea-mirror

2026-05-05 05:36:53 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 05:36:58 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 21, 2016):

Yes, I'll bring them in one by one, as I clean them up.

I put in test/profiles directory, if you want to play with them. I use expect (apt-get expect) and I use "grep TESTING" as a marker to monitor the results. Start the test as "make test-profiles" in the main directory. Modify whatever you need to integrate it on your side. Thank you for your help.

@netblue30 commented on GitHub (Apr 21, 2016): Yes, I'll bring them in one by one, as I clean them up. I put in test/profiles directory, if you want to play with them. I use expect (apt-get expect) and I use "grep TESTING" as a marker to monitor the results. Start the test as "make test-profiles" in the main directory. Modify whatever you need to integrate it on your side. Thank you for your help.

gitea-mirror commented

2026-05-05 05:37:00 -06:00

Author

Owner

@reinerh commented on GitHub (Jun 1, 2016):

Thanks! The tests are now running: https://ci.debian.net/packages/f/firejail/

Unfortunately firejail detects an existing sandbox, as it is running inside LXC.
I haven't detected this in my local setup, as I was using qemu as isolation for running the tests.
I'm currently trying to get it also running in LXC to reproduce it.

@reinerh commented on GitHub (Jun 1, 2016): Thanks! The tests are now running: https://ci.debian.net/packages/f/firejail/ Unfortunately firejail detects an existing sandbox, as it is running inside LXC. I haven't detected this in my local setup, as I was using qemu as isolation for running the tests. I'm currently trying to get it also running in LXC to reproduce it.

gitea-mirror commented

2026-05-05 05:37:02 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 2, 2016):

I'll have to implement LXC detection and not to disable the sandbox - and the same for Docker.

@netblue30 commented on GitHub (Jun 2, 2016): I'll have to implement LXC detection and not to disable the sandbox - and the same for Docker.

gitea-mirror commented

2026-05-05 05:37:03 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 2, 2016):

I put a fix in to recognize lxc (28641d918e), and start the sandbox the normal way, without and "--force" flag necessary. I'm testing on jessie like this:

$ sudo apt-get install lxc
$ sudo lxc-execute -n vm1 -- /bin/bash
# env | grep container
container=lxc
# export DISPLAY=:0
# export TERM=xterm
# /sbin/ifconfig lo up

This starts as root a very simple lxc sandbox, with the original filesystem and a network namespace with a single interface, lo. LXC sets by default "container=lxc" env variable - I use it to detect the lxc sandbox. Also, most of normal env variables are missing, so I set some of them. Then, I start the test:

# su username
$ make test

I still have some tests failing, probably because of missing evn variables. I am looking into them.

@netblue30 commented on GitHub (Jun 2, 2016): I put a fix in to recognize lxc (https://github.com/netblue30/firejail/commit/28641d918e696b03f5c0c4deecac458986f35dec), and start the sandbox the normal way, without and "--force" flag necessary. I'm testing on jessie like this: ``` $ sudo apt-get install lxc $ sudo lxc-execute -n vm1 -- /bin/bash # env | grep container container=lxc # export DISPLAY=:0 # export TERM=xterm # /sbin/ifconfig lo up ``` This starts as root a very simple lxc sandbox, with the original filesystem and a network namespace with a single interface, lo. LXC sets by default "container=lxc" env variable - I use it to detect the lxc sandbox. Also, most of normal env variables are missing, so I set some of them. Then, I start the test: ``` # su username $ make test ``` I still have some tests failing, probably because of missing evn variables. I am looking into them.

gitea-mirror commented

2026-05-05 05:37:04 -06:00

Author

Owner

@reinerh commented on GitHub (Jun 4, 2016):

I have now cherry-picked your commit (28641d9) into 0.9.40-2 in Debian, but unfortunately it still doesn't detect that it is running in LXC.
I think the container variable is only available to the first process inside the container (init), and is not set on normal login sessions.

@reinerh commented on GitHub (Jun 4, 2016): I have now cherry-picked your commit (28641d9) into 0.9.40-2 in Debian, but unfortunately it still doesn't detect that it is running in LXC. I think the container variable is only available to the first process inside the container (init), and is not set on normal login sessions.

gitea-mirror commented

2026-05-05 05:37:05 -06:00

Author

Owner

@reinerh commented on GitHub (Jun 4, 2016):

Another possibility seems to be checking /proc/1/environ for the environment variable, or if systemd is running /run/systemd/container.
(https://sources.debian.net/src/systemd/229-5/src/basic/virt.c/#L371)

@reinerh commented on GitHub (Jun 4, 2016): Another possibility seems to be checking `/proc/1/environ` for the environment variable, or if systemd is running `/run/systemd/container`. (https://sources.debian.net/src/systemd/229-5/src/basic/virt.c/#L371)

gitea-mirror commented

2026-05-05 05:37:07 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 7, 2016):

I've figured out something: maybe just adding the missing environment variable will be enough to get you started. Instead of "make test" give it a try with "container=lxc make test". Thanks!

@netblue30 commented on GitHub (Jun 7, 2016): I've figured out something: maybe just adding the missing environment variable will be enough to get you started. Instead of "make test" give it a try with "container=lxc make test". Thanks!

gitea-mirror commented

2026-05-05 05:37:08 -06:00

Author

Owner

@reinerh commented on GitHub (Jun 7, 2016):

This will probably work, yes. But that would only be a workaround.
Normal users in LXC containers will still have this issue and have to use --force, or export the container variable in their .bashrc or so.

@reinerh commented on GitHub (Jun 7, 2016): This will probably work, yes. But that would only be a workaround. Normal users in LXC containers will still have this issue and have to use `--force`, or export the container variable in their .bashrc or so.

gitea-mirror commented

2026-05-05 05:37:09 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 8, 2016):

OK, fixed by reading /proc/1/environ. This is the commit: 9fafef8e00

@netblue30 commented on GitHub (Jun 8, 2016): OK, fixed by reading /proc/1/environ. This is the commit: https://github.com/netblue30/firejail/commit/9fafef8e0054176a7af4eb8786fb7ceefaf73026

gitea-mirror commented

2026-05-05 05:37:11 -06:00

Author

Owner

@reinerh commented on GitHub (Jun 8, 2016):

Thanks a lot! I just tested it on my system in LXC and it works correctly. :-)

@reinerh commented on GitHub (Jun 8, 2016): Thanks a lot! I just tested it on my system in LXC and it works correctly. :-)

gitea-mirror commented

2026-05-05 05:37:12 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 9, 2016):

I didn't get a chance to test it, so it is in your hands for now. I guess some of the profiles will break. Will fix them one by one. Thanks!

@netblue30 commented on GitHub (Jun 9, 2016): I didn't get a chance to test it, so it is in your hands for now. I guess some of the profiles will break. Will fix them one by one. Thanks!

gitea-mirror commented

2026-05-05 05:37:13 -06:00

Author

Owner

@reinerh commented on GitHub (Jun 16, 2016):

LXC detection is working now, confirmed on ci.debian.net, so I'll close this issue.
(Though there are still a few test failures, but that's unrelated to this.)

@reinerh commented on GitHub (Jun 16, 2016): LXC detection is working now, confirmed on [ci.debian.net](https://ci.debian.net/packages/f/firejail/unstable/amd64/), so I'll close this issue. (Though there are still a few test failures, but that's unrelated to this.)

Rows
Columns

[GH-ISSUE #464] firejail detects existing sandbox in lxc #333