authorized_keys #4044

New issue

Closed

opened 2026-05-05 10:12:44 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 10:12:44 -06:00

Owner

📋 Pull Request Information

Original PR: https://github.com/netblue30/firejail/pull/1689
Author: @gerasiov
Created: 12/22/2017
Status: ✅ Merged
Merged: 12/22/2017
Merged by: @Fred-Barclay

Base: master ← Head: master

📝 Commits (1)

b5542fc disable-common.inc: read-only access to ~/.ssh/authorized_keys

📊 Changes

1 file changed (+3 additions, -0 deletions)

View changed files

📝 etc/disable-common.inc (+3 -0)

📄 Description

disable-common.inc blacklists whole .ssh, but some profiles (e.g. idea.sh)
unblacklists it to allow git over ssh with public key auth.

But this creates security hole, since firejailed app could modify
~/.ssh/authorized_keys and allow arbitrary code execution on the host with sshd
installed (e.g. ssh localhost and run any program) or even open backdoor for
remote attacker.

This commits disallows write access to ~/.ssh/authorized_keys even if .ssh was
unblacklisted.

Signed-off-by: Alexander GQ Gerasiov gq@cs.msu.su

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/netblue30/firejail/pull/1689 **Author:** [@gerasiov](https://github.com/gerasiov) **Created:** 12/22/2017 **Status:** ✅ Merged **Merged:** 12/22/2017 **Merged by:** [@Fred-Barclay](https://github.com/Fred-Barclay) **Base:** `master` ← **Head:** `master` --- ### 📝 Commits (1) - [`b5542fc`](https://github.com/netblue30/firejail/commit/b5542fc94863a4f0fd016c6ea3ab81c14890ff7b) disable-common.inc: read-only access to ~/.ssh/authorized_keys ### 📊 Changes **1 file changed** (+3 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `etc/disable-common.inc` (+3 -0) </details> ### 📄 Description disable-common.inc blacklists whole .ssh, but some profiles (e.g. idea.sh) unblacklists it to allow git over ssh with public key auth. But this creates security hole, since firejailed app could modify ~/.ssh/authorized_keys and allow arbitrary code execution on the host with sshd installed (e.g. ssh localhost and run any program) or even open backdoor for remote attacker. This commits disallows write access to ~/.ssh/authorized_keys even if .ssh was unblacklisted. Signed-off-by: Alexander GQ Gerasiov <gq@cs.msu.su> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

gitea-mirror

2026-05-05 10:12:44 -06:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#4044

No description provided.

Rows
Columns