github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #817] Cannot use mlocate within Firejail #553

New issue

Closed

opened 2026-05-05 06:07:05 -06:00 by gitea-mirror · 7 comments

gitea-mirror commented

2026-05-05 06:07:05 -06:00

Owner

Originally created by @chiraag-nataraj on GitHub (Sep 27, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/817

I use this profile for my terminal emulator

caps.drop all
seccomp
netfilter
private-dev
noroot
net none
protocol unix
whitelist /tmp/user/1000/
whitelist /tmp/.X11-unix/

noexec /tmp

If I try to use locate inside a jailed terminal, I get locate: can not open '/var/lib/mlocate/mlocate.db': Permission denied. I tried not using noroot, but locate still didn't work.

Originally created by @chiraag-nataraj on GitHub (Sep 27, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/817 I use this profile for my terminal emulator ``` caps.drop all seccomp netfilter private-dev noroot net none protocol unix whitelist /tmp/user/1000/ whitelist /tmp/.X11-unix/ noexec /tmp ``` If I try to use locate inside a jailed terminal, I get `locate: can not open '/var/lib/mlocate/mlocate.db': Permission denied`. I tried not using `noroot`, but locate still didn't work.

gitea-mirror

2026-05-05 06:07:05 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 06:07:13 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Sep 27, 2016):

Huh. The issue goes away if I comment out protocol unix, noroot, and seccomp. Why would that be? Let's forget about protocol unix since I don't need that (since I have net none anyway). noroot makes sense since the locate database is owned by root. But why seccomp?

@chiraag-nataraj commented on GitHub (Sep 27, 2016): Huh. The issue goes away if I comment out `protocol unix`, `noroot`, and `seccomp`. Why would that be? Let's forget about `protocol unix` since I don't need that (since I have `net none` anyway). `noroot` makes sense since the locate database is owned by `root`. But why `seccomp`?

gitea-mirror commented

2026-05-05 06:07:15 -06:00

Author

Owner

@netblue30 commented on GitHub (Sep 27, 2016):

I have no idea what is going on. I also tried to "strace locate some-program" without any sandboxing, and it would not work. I think they are doing something very unusual. Seccomp doesn't report anything in /var/log/audit/audit.log, so nothing is killed by seccomp.

@netblue30 commented on GitHub (Sep 27, 2016): I have no idea what is going on. I also tried to "strace locate some-program" without any sandboxing, and it would not work. I think they are doing something very unusual. Seccomp doesn't report anything in /var/log/audit/audit.log, so nothing is killed by seccomp.

gitea-mirror commented

2026-05-05 06:07:18 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Sep 27, 2016):

I'm looking into whether GNU locate behaves like this.

@chiraag-nataraj commented on GitHub (Sep 27, 2016): I'm looking into whether GNU locate behaves like this.

gitea-mirror commented

2026-05-05 06:07:21 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Sep 27, 2016):

GNU locate works fine even with noroot and seccomp. Weird.

@chiraag-nataraj commented on GitHub (Sep 27, 2016): GNU locate works fine even _with_ `noroot` and `seccomp`. Weird.

gitea-mirror commented

2026-05-05 06:07:24 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Sep 27, 2016):

So I'm looking at the mlocate source (here) and it seems it's doing some setgid stuff...would that be blocked by firejail?

@chiraag-nataraj commented on GitHub (Sep 27, 2016): So I'm looking at the mlocate source ([here](https://fedorahosted.org/mlocate/browser/src/locate.c)) and it seems it's doing some setgid stuff...would that be blocked by firejail?

gitea-mirror commented

2026-05-05 06:07:28 -06:00

Author

Owner

@netblue30 commented on GitHub (Sep 27, 2016):

Yes, if it results in rising privileges.

@netblue30 commented on GitHub (Sep 27, 2016): Yes, if it results in rising privileges.

gitea-mirror commented

2026-05-05 06:07:31 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Sep 27, 2016):

That might explain why it's not working if seccomp is in effect. Huh, interesting.

@chiraag-nataraj commented on GitHub (Sep 27, 2016): That might explain why it's not working if `seccomp` is in effect. Huh, interesting.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#553

No description provided.

Rows
Columns