github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #802] Breakout through terminal #545

New issue

Closed

opened 2026-05-05 06:05:52 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 06:05:52 -06:00

Owner

Originally created by @DavidBrandly on GitHub (Sep 22, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/802

Executing mate-terminal -e "sudo su -c 'whoami > /file'" in a firejail session creates a file under / as root.

Originally created by @DavidBrandly on GitHub (Sep 22, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/802 Executing `mate-terminal -e "sudo su -c 'whoami > /file'"` in a firejail session creates a file under `/` as root.

gitea-mirror closed this issue

2026-05-05 06:05:53 -06:00

gitea-mirror commented

2026-05-05 06:05:55 -06:00

Author

Owner

@netblue30 commented on GitHub (Sep 22, 2016):

mate-terminal and a bunch of other terminals are disabled in /etc/firejail/disable-programs.inc. A real exploit going directly to DBus and exploiting gnome-terminal is described here: https://github.com/netblue30/firejail/issues/796. It should work the same for mate-terminal.

@netblue30 commented on GitHub (Sep 22, 2016): mate-terminal and a bunch of other terminals are disabled in /etc/firejail/disable-programs.inc. A real exploit going directly to DBus and exploiting gnome-terminal is described here: https://github.com/netblue30/firejail/issues/796. It should work the same for mate-terminal.

gitea-mirror commented

2026-05-05 06:05:57 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Sep 22, 2016):

@DavidBrandly As netblue30 mentioned, mate-terminal has been blacklisted in the last two releases of firejail due to this very behavior. Do you perchance have an older version of firejail?

Firejail 0.9.43 (current development version):

$ mate-terminal -e "sudo su -c 'whoami > /file'"
bash: /usr/bin/mate-terminal: Permission denied

$ mate-terminal -e "sudo su -c 'whoami > /file'"
dash: 1: mate-terminal: Permission denied

@Fred-Barclay commented on GitHub (Sep 22, 2016): @DavidBrandly As netblue30 mentioned, `mate-terminal` has been blacklisted in the last two releases of firejail due to this very behavior. Do you perchance have an older version of firejail? Firejail 0.9.43 (current development version): ``` $ mate-terminal -e "sudo su -c 'whoami > /file'" bash: /usr/bin/mate-terminal: Permission denied ``` ``` $ mate-terminal -e "sudo su -c 'whoami > /file'" dash: 1: mate-terminal: Permission denied ```

gitea-mirror commented

2026-05-05 06:05:59 -06:00

Author

Owner

@DavidBrandly commented on GitHub (Sep 23, 2016):

@Fred-Barclay I hadn't noticed that apt has been holding back firejail. It's updated now, thanks for the help!

@DavidBrandly commented on GitHub (Sep 23, 2016): @Fred-Barclay I hadn't noticed that apt has been holding back firejail. It's updated now, thanks for the help!

gitea-mirror commented

2026-05-05 06:06:01 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Sep 23, 2016):

@DavidBrandly No worries, mate. 😄

@Fred-Barclay commented on GitHub (Sep 23, 2016): @DavidBrandly No worries, mate. :smile:

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#545

No description provided.

Rows
Columns