github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #690] Profile for symlinked programs #474

New issue

Closed

opened 2026-05-05 05:55:44 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 05:55:44 -06:00

Owner

Originally created by @reinerh on GitHub (Aug 7, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/690

I just noticed a test failure of strings.exp in a newly setup VM.
It turns out that the reason is that strings is symlinked to x86_64-linux-gnu-strings and firejail is trying to load the profile for x86_64-linux-gnu-strings, which does not exist, so it uses the server profile.

I can't think of any security concerns to fall back to the profile of the symlink source, when the profile for the symlink destination does not exist, if both are in one of the standard binary paths (or even any root-owned path?).

Originally created by @reinerh on GitHub (Aug 7, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/690 I just noticed a test failure of strings.exp in a newly setup VM. It turns out that the reason is that _strings_ is symlinked to _x86_64-linux-gnu-strings_ and firejail is trying to load the profile for x86_64-linux-gnu-strings, which does not exist, so it uses the server profile. I can't think of any security concerns to fall back to the profile of the symlink source, when the profile for the symlink destination does not exist, if both are in one of the standard binary paths (or even any root-owned path?).

gitea-mirror

2026-05-05 05:55:44 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 05:55:50 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 9, 2016):

Let's just remove strings profile for now. The issue of falling back to the symlink source profile came up earlier, but I don't remember why I didn't go for it.

@netblue30 commented on GitHub (Aug 9, 2016): Let's just remove strings profile for now. The issue of falling back to the symlink source profile came up earlier, but I don't remember why I didn't go for it.

gitea-mirror commented

2026-05-05 05:55:52 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 11, 2016):

OK, this seems to be something new in Debian unstable, in jessie is still a real executable. I'll add a profile for x86_64-linux-gnu-strings.

@netblue30 commented on GitHub (Aug 11, 2016): OK, this seems to be something new in Debian unstable, in jessie is still a real executable. I'll add a profile for x86_64-linux-gnu-strings.

gitea-mirror commented

2026-05-05 05:55:54 -06:00

Author

Owner

@reinerh commented on GitHub (Aug 11, 2016):

On Thu, Aug 11, 2016 at 04:07:42AM -0700, netblue30 wrote:

OK, this seems to be something new in Debian unstable, in jessie is still a real executable.
I'll add a profile for x86_64-linux-gnu-strings.

I'm not sure if that's a good idea.
The name varies with each architecture, and it's not only strings, but
also the other binutils.

I think it would be better to have only a profile for strings, and use
this one, even when it is a symlink (in a known path).

@reinerh commented on GitHub (Aug 11, 2016): On Thu, Aug 11, 2016 at 04:07:42AM -0700, netblue30 wrote: > OK, this seems to be something new in Debian unstable, in jessie is still a real executable. > I'll add a profile for x86_64-linux-gnu-strings. I'm not sure if that's a good idea. The name varies with each architecture, and it's not only strings, but also the other binutils. I think it would be better to have only a profile for strings, and use this one, even when it is a symlink (in a known path).

gitea-mirror commented

2026-05-05 05:55:56 -06:00

Author

Owner

@reinerh commented on GitHub (Aug 24, 2016):

The symlink issue is also biting Ubuntu users [1].
firefox (and thunderbird) is a symlink to a firefox.sh shell script/wrapper, where firejail will not use the firefox profile.

1: https://bugs.launchpad.net/ubuntu/+source/firejail/+bug/1616334

@reinerh commented on GitHub (Aug 24, 2016): The symlink issue is also biting Ubuntu users [1]. firefox (and thunderbird) is a symlink to a firefox.sh shell script/wrapper, where firejail will not use the firefox profile. 1: https://bugs.launchpad.net/ubuntu/+source/firejail/+bug/1616334

gitea-mirror commented

2026-05-05 05:55:58 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 25, 2016):

Thanks for letting me know. I'll bring in a fix as you suggested on mainline branch.

Ubuntu user reporting the bug runs 0.9.38. I have a fix in 0.9.40, it basically picks up the profile based on the executable name up to the first dot, so firefox.sh will pick up firefox profile correctly.

There's something else going on:

I started a 0.9.38 long term support branch, with only small fixes and security problems. I'll put in the same fix I have in 0.9.40 and release it by the end of the week. You can direct the user to download this version (I'll have 32 and 64 bit deb packages) or you can direct him to download directly 0.9.40.

@netblue30 commented on GitHub (Aug 25, 2016): Thanks for letting me know. I'll bring in a fix as you suggested on mainline branch. Ubuntu user reporting the bug runs 0.9.38. I have a fix in 0.9.40, it basically picks up the profile based on the executable name up to the first dot, so firefox.sh will pick up firefox profile correctly. There's something else going on: I started a 0.9.38 long term support branch, with only small fixes and security problems. I'll put in the same fix I have in 0.9.40 and release it by the end of the week. You can direct the user to download this version (I'll have 32 and 64 bit deb packages) or you can direct him to download directly 0.9.40.

gitea-mirror commented

2026-05-05 05:56:01 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 25, 2016):

Fixed!

@netblue30 commented on GitHub (Aug 25, 2016): Fixed!

gitea-mirror referenced this issue

2026-05-05 10:05:04 -06:00

[PR #474] [MERGED] Create quiterss.profile #3636

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#474

No description provided.

Rows
Columns