github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

hosts #3468

New issue

Closed

opened 2026-05-05 10:00:56 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 10:00:56 -06:00

Owner

Originally created by @liloman on GitHub (Jan 29, 2026).
Original GitHub issue: https://github.com/netblue30/firejail/issues/7048

Description

I was digging to resolve a problem with a sandbox till I discovered the root issue, the sandbox wasn't trying both ip stacks, as a fallback, inside the sandbox.

Steps to Reproduce

$ firejail --noprofile telnet localhost 80
firejail version 0.9.78

Parent pid 46456, child pid 46457
Base filesystem installed in 0.04 ms
Child process initialized in 17.78 ms
Trying ::1...
telnet: connect to address ::1: Connection refused

Parent is shutting down, bye...

Expected behavior

$ firejail telnet localhost 80
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection refused

Additional context

I've been trying to understand what's the difference but without a conclusion. Even using --ignore=private-etc keeps failing.
The real issue was android studio trying to connect to a local port for debugging purposes and failing to do it so, cause not trying on ipv4 after ipv6 failed...

Unfortunately jail_prober.py wasn't a help here cause it affects even --noprofile :(

Environment

Version of Firejail

$ firejail --version
firejail version 0.9.78

Checklist

I am using firejail 0.9.78 or later
I am using the full program path (e.g. firejail /usr/bin/vlc instead of firejail vlc; see https://github.com/netblue30/firejail/issues/2877)
The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail /path/to/program

output goes here

Output of LC_ALL=C firejail --debug /path/to/program

output goes here

Originally created by @liloman on GitHub (Jan 29, 2026). Original GitHub issue: https://github.com/netblue30/firejail/issues/7048  ### Description I was digging to resolve a problem with a sandbox till I discovered the root issue, the sandbox wasn't trying both ip stacks, as a fallback, inside the sandbox. ### Steps to Reproduce ```console $ firejail --noprofile telnet localhost 80 firejail version 0.9.78 Parent pid 46456, child pid 46457 Base filesystem installed in 0.04 ms Child process initialized in 17.78 ms Trying ::1... telnet: connect to address ::1: Connection refused Parent is shutting down, bye... ``` ### Expected behavior ```console $ firejail telnet localhost 80 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... telnet: connect to address 127.0.0.1: Connection refused ``` ### Additional context I've been trying to understand what's the difference but without a conclusion. Even using `--ignore=private-etc` keeps failing. The real issue was android studio trying to connect to a local port for debugging purposes and failing to do it so, cause not trying on ipv4 after ipv6 failed... Unfortunately `jail_prober.py` wasn't a help here cause it affects even `--noprofile` :( ### Environment - Version of Firejail ```console $ firejail --version firejail version 0.9.78 ``` ### Checklist  - [x] I am using firejail [0.9.78 or later](https://github.com/netblue30/firejail/tree/master/SECURITY.md) - [x] I am using the full program path (e.g. `firejail /usr/bin/vlc` instead of `firejail vlc`; see `https://github.com/netblue30/firejail/issues/2877`) - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <details> <summary>Output of <code>LC_ALL=C firejail /path/to/program</code></summary> <p> ``` output goes here ``` </p> </details> <details> <summary>Output of <code>LC_ALL=C firejail --debug /path/to/program</code></summary> <p>  ``` output goes here ``` </p> </details>

gitea-mirror

2026-05-05 10:00:56 -06:00

closed this issue
added the
bug

networking
labels

gitea-mirror commented

2026-05-05 10:00:59 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 29, 2026):

How does /etc/hosts look in the sandbox?

@rusty-snake commented on GitHub (Jan 29, 2026): How does `/etc/hosts` look in the sandbox?

gitea-mirror commented

2026-05-05 10:01:00 -06:00

Author

Owner

@liloman commented on GitHub (Jan 30, 2026):

I see.

So every time you execute firejail it creates a random hostname and modify /etc/hosts to assign that random hostname to 127.0.0.1.

I see 2 issues:

1)BUG: When it creates a random hostname never execute sethostname, so hostname is not set properly as when you assign it with --hostname=mi-name
You can see it clearly on your bash prompt (PS1)

2)BUG: You loose localhost ipv4 resolution and don't care about ipv6. It should add the hostname(random/set) to ipv4 and ipv6 lines

How do you think I should report these issues?

@liloman commented on GitHub (Jan 30, 2026): I see. So every time you execute firejail it creates a random hostname and modify /etc/hosts to assign that random hostname to 127.0.0.1. I see 2 issues: 1)BUG: When it creates a random hostname never execute sethostname, so hostname is not set properly as when you assign it with --hostname=mi-name You can see it clearly on your bash prompt (PS1) 2)BUG: You loose localhost ipv4 resolution and don't care about ipv6. It should add the hostname(random/set) to ipv4 and ipv6 lines How do you think I should report these issues?

gitea-mirror commented

2026-05-05 10:01:01 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 3, 2026):

Marking it as a bug. I'll add an option to disabled the automatic replacement of /etc/hostname

@netblue30 commented on GitHub (Feb 3, 2026): Marking it as a bug. I'll add an option to disabled the automatic replacement of /etc/hostname

gitea-mirror commented

2026-05-05 10:01:01 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 8, 2026):

You can try it now. Add --keep-hostname on the command line.

@netblue30 commented on GitHub (Feb 8, 2026): You can try it now. Add --keep-hostname on the command line.

gitea-mirror commented

2026-05-05 10:01:01 -06:00

Author

Owner

@kmk3 commented on GitHub (Feb 24, 2026):

1)BUG: When it creates a random hostname never execute sethostname, so
hostname is not set properly as when you assign it with --hostname=mi-name
You can see it clearly on your bash prompt (PS1)

Should be fixed by:

6f164f415 ("--keep-hostname part 2 (#7048)", 2026-02-03)

2)BUG: You loose localhost ipv4 resolution and don't care about ipv6. It
should add the hostname(random/set) to ipv4 and ipv6 lines

ipv4 should be fixed by:

6f164f415 ("--keep-hostname part 2 (#7048)", 2026-02-03)

ipv6 should be fixed by:

#7077

Edit: I'll add localhost lines after #7077.

@kmk3 commented on GitHub (Feb 24, 2026): > 1)BUG: When it creates a random hostname never execute sethostname, so > hostname is not set properly as when you assign it with --hostname=mi-name > You can see it clearly on your bash prompt (PS1) Should be fixed by: * 6f164f415 ("--keep-hostname part 2 (#7048)", 2026-02-03) > 2)BUG: You loose localhost ipv4 resolution and don't care about ipv6. It > should add the hostname(random/set) to ipv4 and ipv6 lines ipv4 should be fixed by: * 6f164f415 ("--keep-hostname part 2 (#7048)", 2026-02-03) ipv6 should be fixed by: * #7077 Edit: I'll add localhost lines after #7077.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3468

No description provided.

Rows
Columns