github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #483] private dir owner #344

New issue

Closed

opened 2026-05-05 05:38:32 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 05:38:32 -06:00

Owner

Originally created by @saddy001 on GitHub (Apr 26, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/483

I tried to sandbox pidgin like so:
firejail --blacklist=/media --private=~/Programme/telegram --net=lxcbr0 --dns=8.8.8.8 --nosound pidgin
In order to prevent it from reading my directories, accessing my private network etc. The first time it started fine but then it doesn't start up any more (the GUI window does not show). I see some dbus errors...

(Pidgin:2): GLib-GIO-CRITICAL **: g_dbus_connection_get_unique_name: assertion 'G_IS_DBUS_CONNECTION (connection)' failed
(Pidgin:2): GLib-GIO-CRITICAL **: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed
(Pidgin:2): libnotify-WARNING **: Failed to connect to proxy

And when I start into a shell I see "groups: Es ist kein Name zur Gruppen‐ID 65534 zu finden" (No name found for this group ID).
ls -hla says
...
dr-x------ 2 65534 65534 40 Apr 26 19:17 .purple
So it seems that the pidgin process created this dir with user/group "65534" which doesn't exist. It tried to chown the dir from outside the sandbox, which was successful, but from the inside it shows the same invalid owner again.
Thanks for your great work by the way.

Originally created by @saddy001 on GitHub (Apr 26, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/483 I tried to sandbox pidgin like so: `firejail --blacklist=/media --private=~/Programme/telegram --net=lxcbr0 --dns=8.8.8.8 --nosound pidgin` In order to prevent it from reading my directories, accessing my private network etc. The first time it started fine but then it doesn't start up any more (the GUI window does not show). I see some dbus errors... ``` (Pidgin:2): GLib-GIO-CRITICAL **: g_dbus_connection_get_unique_name: assertion 'G_IS_DBUS_CONNECTION (connection)' failed (Pidgin:2): GLib-GIO-CRITICAL **: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed (Pidgin:2): libnotify-WARNING **: Failed to connect to proxy ``` And when I start into a shell I see "groups: Es ist kein Name zur Gruppen‐ID 65534 zu finden" (No name found for this group ID). ls -hla says ... dr-x------ 2 65534 65534 40 Apr 26 19:17 .purple So it seems that the pidgin process created this dir with user/group "65534" which doesn't exist. It tried to chown the dir from outside the sandbox, which was successful, but from the inside it shows the same invalid owner again. Thanks for your great work by the way.

gitea-mirror closed this issue

2026-05-05 05:38:34 -06:00

gitea-mirror commented

2026-05-05 05:38:39 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 27, 2016):

dr-x------ 2 65534 65534 40 Apr 26 19:17 .purple

65534 is a very low privileges user/group the kernel is using as a place holder for users and groups not covered by the user namespace.

In my opinion this is a kernel problem. I've seen it coming and going on older kernels. I think it was fixed on newer kernels, Since I moved to 4.3 I didn't get it anymore.

This is how you fix it: reboot the machine, and before you start the sandbox you go in ~/Programme/telegram and change the user/group:

$ cd  ~/Programme/telegram
$ sudo chown username:groupname .purple

Your directory should look something like this:

$ ls -al
total 28
drwxrwxr-x  5 netblue netblue 4096 Apr 26 22:02 .
drwxr-xr-x 35 netblue netblue 4096 Apr 26 22:00 ..
-rw-r--r--  1 netblue netblue 3771 Apr 26 22:02 .bashrc
drwxrwxr-x  3 netblue netblue 4096 Apr 26 22:02 .cache
drwxr-xr-x  5 netblue netblue 4096 Apr 26 22:02 .config
drwx------  4 netblue netblue 4096 Apr 26 22:02 .purple
-rw-------  1 netblue netblue  388 Apr 26 22:02 .Xauthority

@netblue30 commented on GitHub (Apr 27, 2016): > dr-x------ 2 65534 65534 40 Apr 26 19:17 .purple 65534 is a very low privileges user/group the kernel is using as a place holder for users and groups not covered by the user namespace. In my opinion this is a kernel problem. I've seen it coming and going on older kernels. I think it was fixed on newer kernels, Since I moved to 4.3 I didn't get it anymore. This is how you fix it: reboot the machine, and before you start the sandbox you go in ~/Programme/telegram and change the user/group: ``` $ cd ~/Programme/telegram $ sudo chown username:groupname .purple ``` Your directory should look something like this: ``` $ ls -al total 28 drwxrwxr-x 5 netblue netblue 4096 Apr 26 22:02 . drwxr-xr-x 35 netblue netblue 4096 Apr 26 22:00 .. -rw-r--r-- 1 netblue netblue 3771 Apr 26 22:02 .bashrc drwxrwxr-x 3 netblue netblue 4096 Apr 26 22:02 .cache drwxr-xr-x 5 netblue netblue 4096 Apr 26 22:02 .config drwx------ 4 netblue netblue 4096 Apr 26 22:02 .purple -rw------- 1 netblue netblue 388 Apr 26 22:02 .Xauthority ```

gitea-mirror commented

2026-05-05 05:38:41 -06:00

Author

Owner

@saddy001 commented on GitHub (Apr 30, 2016):

Thanks for your reply.
What you suggested is what I meant with "chown the dir from outside the sandbox" but it didn't work, even after a fresh reboot and chown. The dir looks proper from outside the sandbox:
ls -hla Programme/telegram/
drwx------ 5 saddy saddy 4,0K Apr 27 20:05 .purple

But inside it has the same unprivileged owner:
dr-x------ 2 65534 65534 40 Apr 30 15:40 .purple
which I cannot change from inside the sandbox. Indeed I'm on a 3.13 Kernel, but since I will switch soon, I close this issue. Thanks.

@saddy001 commented on GitHub (Apr 30, 2016): Thanks for your reply. What you suggested is what I meant with "chown the dir from outside the sandbox" but it didn't work, even after a fresh reboot and chown. The dir looks proper from outside the sandbox: ls -hla Programme/telegram/ drwx------ 5 saddy saddy 4,0K Apr 27 20:05 .purple But inside it has the same unprivileged owner: dr-x------ 2 65534 65534 40 Apr 30 15:40 .purple which I cannot change from inside the sandbox. Indeed I'm on a 3.13 Kernel, but since I will switch soon, I close this issue. Thanks.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#344

No description provided.

Rows
Columns