mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 22:01:33 -06:00
[GH-ISSUE #820] dnscrypt-proxy.profile fails with private-dev option enabled #556
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#556
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ghost on GitHub (Sep 27, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/820
/etc/firejail/dnscrypt-proxy.profile (latest firejail from git) seems to have a problem with 'private-dev' option:
$ lsb_release -d
Description: Ubuntu 16.04.1 LTS
dnscrypt-proxy compiled from latest git
$ dnscrypt-proxy -V
dnscrypt-proxy 1.7.0
$ cat /etc/firejail/dnscrypt-proxy
#security profile for dnscrypt-proxynoblacklist /sbin
noblacklist /usr/sbin
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
private
private-dev
nosound
seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open
$ sudo /usr/bin/firejail --noblacklist=/usr/local/sbin dnscrypt-proxy --local-address=127.0.2.1 --resolver-name=dnscrypt.eu-dk --user=dnscrypt --ephemeral-keys --plugin=libdcplugin_example_ldns_aaaa_blocking.so
Reading profile /etc/firejail/dnscrypt-proxy.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Parent pid 21256, child pid 21257
The new log directory is /proc/21257/root/var/log
Error mounting /dev/snd: fs_dev.c:68 deventry_mount: Not a directory
Error: cannot establish communication with the parent, exiting...
Running
$ sudo /usr/bin/firejail --ignore=private-dev --noblacklist=/usr/local/sbin dnscrypt-proxy --local-address=127.0.2.1 --resolver-name=dnscrypt.eu-dk --user=dnscrypt --ephemeral-keys --plugin=libdcplugin_example_ldns_aaaa_blocking.so
works as expected..
Regards
@netblue30 commented on GitHub (Sep 27, 2016):
What version of firejail are you using (firejail --version)?
@ghost commented on GitHub (Sep 27, 2016):
Sorry, forgot to add that, it's the latest from git
$ firejail --version
firejail version 0.9.43
@netblue30 commented on GitHub (Sep 27, 2016):
I put in git some debug code, give it a try with --debug option:
@ghost commented on GitHub (Sep 27, 2016):
No change yet I'm afraid..
$ sudo /usr/bin/firejail --debug --noblacklist=/usr/local/sbin dnscrypt-proxy --local-address=127.0.2.1 --resolver-name=dnscrypt.eu-dk --user=dnscrypt --ephemeral-keys --plugin=libdcplugin_example_ldns_aaaa_blocking.so
Reading profile /etc/firejail/dnscrypt-proxy.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Autoselecting /bin/bash as shell
Command name #dnscrypt-proxy#
Found dnscrypt-proxy profile in /etc/firejail directory
DISPLAY :0.0, 0
Enabling IPC namespace
Using the local network stack
Parent pid 2027, child pid 2028
The new log directory is /proc/2028/root/var/log
Host network configured
Error mounting dev file: fs_dev.c:70 deventry_mount: Not a directory
Autoselecting /bin/bash as shell
Command name #dnscrypt-proxy#
Found dnscrypt-proxy profile in /etc/firejail directory
DISPLAY :0.0, 0
Enabling IPC namespace
Using the local network stack
Initializing child process
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Mounting read-only /bin, /sbin, /lib, /lib32, /lib64, /usr, /etc, /var
Mounting tmpfs on /var/lock
Mounting tmpfs on /var/tmp
Mounting tmpfs on /var/log
Mounting tmpfs on /var/lib/dhcp
Mounting tmpfs on /var/lib/snmp
Mounting tmpfs on /var/lib/sudo
Mounting tmpfs on /var/cache/apache2
Create the new utmp file
Mount the new utmp file
Mounting a new /home directory
Mounting a new /root directory
Mounting tmpfs on /dev
mounting /run/firejail/mnt/dev/snd
mounting /run/firejail/mnt/dev/dri
mounting /run/firejail/mnt/dev/nvidia0
Error: cannot establish communication with the parent, exiting...
Autoselecting /bin/bash as shell
Command name #dnscrypt-proxy#
Found dnscrypt-proxy profile in /etc/firejail directory
DISPLAY :0.0, 0
Enabling IPC namespace
Using the local network stack
Parent pid 2027, child pid 2028
The new log directory is /proc/2028/root/var/log
@netblue30 commented on GitHub (Sep 27, 2016):
I think you are starting the sandbox twice, first manually using the command, and then once again form /usr/local/sbin/dnscrypt-proxy. Do you call firejail from /usr/local/sbin/dnscrypt-proxy? Can you take it out?
@ghost commented on GitHub (Sep 27, 2016):
No I only used your suggested debug command, /usr/local/sbin/dnscrypt-proxy is the unchanged binary installed from git in my Ubuntu partition:
$ sudo /usr/bin/firejail --debug --noblacklist=/usr/local/sbin dnscrypt-proxy --local-address=127.0.2.1 --resolver-name=dnscrypt.eu-dk --user=dnscrypt --ephemeral-keys --plugin=libdcplugin_example_ldns_aaaa_blocking.so
But I did ran that from within a chroot, as I'm in the middle of compiling a fresh custom kernel in Arch Linux (which by the way does not suffer from the error I reported as seen in Ubuntu 16.04). After the compile is ready I'll boot into Ubuntu the regular way and report back. Thanks for your efforts.
@netblue30 commented on GitHub (Sep 27, 2016):
This should do it, how do mount your dev directory in chroot?
@ghost commented on GitHub (Sep 27, 2016):
For clarity, the original error was seen from a regularly booted Ubuntu 16.04 partition (/dev/sda1). I only tested your debug command from inside a chroot, which I mount via a script that has been working without problems for quite some time now. Here's the relevant snippet that mounts /dev in chroot:
mount chroot
sudo mount -t ext4 /dev/sda1 /media/dirkos/chroot.sda1
for i in /dev /dev/pts /run /proc /sys; do sudo mount --bind "$i" "/media/dirkos/chroot.sda1$i"; done
Compile has finished, I'll reboot and do some more testing.
@netblue30 commented on GitHub (Sep 27, 2016):
Give me a debug trace with the command on the original ubuntu partition, chroot is messing things up.
@ghost commented on GitHub (Sep 27, 2016):
$ lsb_release -d
Description: Ubuntu 16.04.1 LTS
$ uname -r
4.4.0-38-generic
$ sudo /usr/bin/firejail --debug --noblacklist=/usr/local/sbin dnscrypt-proxy --local-address=127.0.2.1 --resolver-name=dnscrypt.eu-dk --user=dnscrypt --ephemeral-keys --plugin=libdcplugin_example_ldns_aaaa_blocking.so
Autoselecting /bin/bash as shell
Command name #dnscrypt-proxy#
Found dnscrypt-proxy profile in /etc/firejail directory
Reading profile /etc/firejail/dnscrypt-proxy.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
DISPLAY :0.0, 0
Enabling IPC namespace
Using the local network stack
Parent pid 5212, child pid 5213
The new log directory is /proc/5213/root/var/log
Initializing child process
Host network configured
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Mounting read-only /bin, /sbin, /lib, /lib32, /lib64, /usr, /etc, /var
Mounting tmpfs on /var/lock
Mounting tmpfs on /var/tmp
Mounting tmpfs on /var/log
Mounting tmpfs on /var/lib/dhcp
Mounting tmpfs on /var/lib/snmp
Mounting tmpfs on /var/lib/sudo
Mounting tmpfs on /var/cache/apache2
Create the new utmp file
Mount the new utmp file
Mounting a new /home directory
Mounting a new /root directory
Mounting tmpfs on /dev
mounting /run/firejail/mnt/dev/snd
mounting /run/firejail/mnt/dev/dri
mounting /run/firejail/mnt/dev/nvidia0
Error mounting dev file: fs_dev.c:70 deventry_mount: Not a directory
Error: cannot establish communication with the parent, exiting...
@netblue30 commented on GitHub (Sep 27, 2016):
Wow! That's my bug! I'll bring in a fix tomorrow, thanks for your help.
@ghost commented on GitHub (Sep 27, 2016):
No problem, glad I could help.
@netblue30 commented on GitHub (Sep 28, 2016):
All fixed in git, give it a try, If necessary, I'll reopen the bug. Thanks.