github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #471] Can access children of blacklisted directories by moving directories around outside jail #335

New issue

Closed

opened 2026-05-05 05:37:15 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 05:37:15 -06:00

Owner

Originally created by @ivan on GitHub (Apr 22, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/471

Not sure if this is fixable. Repro steps (tested with firejail 0.9.38) are:

Outside the jail:

mkdir -p $HOME/secret/child
firejail --blacklist=$HOME/secret

Inside the jail:

mkdir stuff
cd stuff

Outside the jail:

mv $HOME/stuff $HOME/secret/child

Inside the jail:

cd ..

And the jail now has full access to $HOME/secret/child even though $HOME/secret is blacklisted.

I discovered this when I moved some folders around and accidentally exposed all my stuff to the jail.

Originally created by @ivan on GitHub (Apr 22, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/471 Not sure if this is fixable. Repro steps (tested with firejail 0.9.38) are: Outside the jail: ``` mkdir -p $HOME/secret/child firejail --blacklist=$HOME/secret ``` Inside the jail: ``` mkdir stuff cd stuff ``` Outside the jail: ``` mv $HOME/stuff $HOME/secret/child ``` Inside the jail: ``` cd .. ``` And the jail now has full access to `$HOME/secret/child` even though `$HOME/secret` is blacklisted. I discovered this when I moved some folders around and accidentally exposed all my stuff to the jail.

gitea-mirror

2026-05-05 05:37:15 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:37:20 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Apr 22, 2016):

Interesting! I can confirm that this also occurs on the current code (just built from source 5 minutes ago), firejail 0.9.40~rc2.

The good news is, that even though firejail has access to /home/secret/child/stuff and /home/secret/child, it cannot cd .. into /home/secret--the blacklist still stands. At least, I haven't been able to get it to yet.

I can see how this could be a problem if you have a secret directory inside another secret directory, and then only blacklist the exterior directory.

Interestingly, if you cd outside the secret directory, you then cannot cd back in:

    [fred@aussie stuff]$ pwd
    /home/fred/secret/child/stuff
    [fred@aussie child]$ cd /home/fred
    [fred@aussie ~]$ pwd
    /home/fred
    [fred@aussie ~]$ cd /home/fred/secret/child/stuff
    bash: cd: /home/fred/secret/child/stuff: Permission denied

Let's say that I have ~/.gnupg/supersecretdir, with a very important file inside. If I attempt to access it directly from a firejail shell, it's denied. However, following the steps that ivan has detailed, it's easy to read the file:

fred@aussie ~ $ firejail
Reading profile /etc/firejail/generic.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-passwdmgr.inc

** Note: you can use --noprofile to disable generic.profile **

Parent pid 29132, child pid 29133

Child process initialized
[fred@aussie ~]$ mkdir attack
[fred@aussie ~]$ cd attack
[fred@aussie attack]$ pwd
/home/fred/attack
[fred@aussie attack]$ ls

Move attack to ~/.gnupg/supresecretdir now

[fred@aussie attack]$ pwd
/home/fred/attack
[fred@aussie attack]$ cd ..
[fred@aussie supersecretdir]$ pwd
/home/fred/.gnupg/supersecretdir
[fred@aussie supersecretdir]$ ls
attack  TOPSECRET
[fred@aussie supersecretdir]$ cat TOPSECRET
TOP SECRET!
TO...
President Petrov, Президент Российской Федерации

Operation Lovejoy has been finalised by the Company. The Spetsnaz and Delta 
Forces will apprehend General Radek tonight at 2100. President Marshall offers
his full support and best wishes.

Perhaps interestingly, even after attack has been moved to .gnupg/supersecretdir, it doesn't seem to be aware of its new location. It's only after cd .. that pwd gives the correct location:

[fred@aussie attack]$ pwd
/home/fred/attack
[fred@aussie attack]$ cd ..
[fred@aussie supersecretdir]$ pwd
/home/fred/.gnupg/supersecretdir

I can even write inside supersecretdir:

[fred@aussie supersecretdir]$ touch HELLO.txt
[fred@aussie supersecretdir]$ ls
attack  HELLO.txt  TOPSECRET

@Fred-Barclay commented on GitHub (Apr 22, 2016): Interesting! I can confirm that this also occurs on the current code (just built from source 5 minutes ago), firejail 0.9.40~rc2. The good news is, that even though firejail has access to `/home/secret/child/stuff` and `/home/secret/child`, it cannot `cd ..` into `/home/secret`--the blacklist still stands. At least, I haven't been able to get it to yet. I can see how this could be a problem if you have a secret directory inside another secret directory, and then only blacklist the exterior directory. Interestingly, if you cd _outside_ the secret directory, you then cannot cd back in: ``` [fred@aussie stuff]$ pwd /home/fred/secret/child/stuff [fred@aussie child]$ cd /home/fred [fred@aussie ~]$ pwd /home/fred [fred@aussie ~]$ cd /home/fred/secret/child/stuff bash: cd: /home/fred/secret/child/stuff: Permission denied ``` Let's say that I have ~/.gnupg/supersecretdir, with a very important file inside. If I attempt to access it directly from a firejail shell, it's denied. However, following the steps that ivan has detailed, it's easy to read the file: ``` fred@aussie ~ $ firejail Reading profile /etc/firejail/generic.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-passwdmgr.inc ** Note: you can use --noprofile to disable generic.profile ** Parent pid 29132, child pid 29133 Child process initialized [fred@aussie ~]$ mkdir attack [fred@aussie ~]$ cd attack [fred@aussie attack]$ pwd /home/fred/attack [fred@aussie attack]$ ls ``` Move `attack` to ~/.gnupg/supresecretdir now ``` [fred@aussie attack]$ pwd /home/fred/attack [fred@aussie attack]$ cd .. [fred@aussie supersecretdir]$ pwd /home/fred/.gnupg/supersecretdir [fred@aussie supersecretdir]$ ls attack TOPSECRET [fred@aussie supersecretdir]$ cat TOPSECRET TOP SECRET! TO... President Petrov, Президент Российской Федерации Operation Lovejoy has been finalised by the Company. The Spetsnaz and Delta Forces will apprehend General Radek tonight at 2100. President Marshall offers his full support and best wishes. ``` Perhaps interestingly, even after `attack` has been moved to .gnupg/supersecretdir, it doesn't seem to be aware of its new location. It's only after `cd ..` that `pwd` gives the correct location: ``` [fred@aussie attack]$ pwd /home/fred/attack [fred@aussie attack]$ cd .. [fred@aussie supersecretdir]$ pwd /home/fred/.gnupg/supersecretdir ``` I can even write inside supersecretdir: ``` [fred@aussie supersecretdir]$ touch HELLO.txt [fred@aussie supersecretdir]$ ls attack HELLO.txt TOPSECRET ```

gitea-mirror commented

2026-05-05 05:37:21 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 22, 2016):

It is like a real jail, you can sabotage it from outside. I don't think we can do anything about it.

@netblue30 commented on GitHub (Apr 22, 2016): It is like a real jail, you can sabotage it from outside. I don't think we can do anything about it.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#335

No description provided.

Rows
Columns