[GH-ISSUE #877] "firejail --chroot=/" destroys resolv.conf #594

New issue

Closed

opened 2026-05-05 06:14:33 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 06:14:33 -06:00

Owner

Originally created by @mcarpenter on GitHub (Oct 27, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/877

This is a silly use case but my broader concern is that this could happen anywhere that copy_file() has identical paths to source and destination arguments. In this case, the file in question is truncated to zero bytes:

martin@ubuntu14:/tmp$ uname -a 
Linux ubuntu14 3.13.0-100-generic #147-Ubuntu SMP Tue Oct 18 16:48:51 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
martin@ubuntu14:/tmp$ firejail --version
firejail version 0.9.45

Compile time support:
    - AppArmor support is disabled
    - AppImage support is enabled
    - bind support is enabled
    - chroot support is enabled
    - file and directory whitelisting support is enabled
    - file transfer support is enabled
    - networking support is enabled
    - overlayfs support is enabled
    - private-home support is enabled
    - seccomp-bpf support is enabled
    - user namespace support is enabled
    - X11 sandboxing support is enabled

martin@ubuntu14:/tmp$ ls -l /etc/resolv.conf
-rw-r--r--. 1 root root 45 Oct 27 08:35 /etc/resolv.conf
martin@ubuntu14:/tmp$ firejail --chroot=/
Warning: default profile disabled by --chroot option
Parent pid 13279, child pid 13280
Dropping all Linux capabilities and enforcing default seccomp filter
Warning: failed to mount /sys
Warning: whitelist feature is disabled in chroot
Child process initialized
martin@ubuntu14:/tmp$ ls -l /etc/resolv.conf
-rw-r--r--. 1 root root 0 Oct 27 08:35 /etc/resolv.conf
martin@ubuntu14:/tmp$ exit

Parent is shutting down, bye...
martin@ubuntu14:/tmp$ ls -l /etc/resolv.conf
-rw-r--r--. 1 root root 0 Oct 27 08:35 /etc/resolv.conf
martin@ubuntu14:/tmp$

Originally created by @mcarpenter on GitHub (Oct 27, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/877 This is a silly use case but my broader concern is that this could happen anywhere that `copy_file()` has identical paths to source and destination arguments. In this case, the file in question is truncated to zero bytes: ``` martin@ubuntu14:/tmp$ uname -a Linux ubuntu14 3.13.0-100-generic #147-Ubuntu SMP Tue Oct 18 16:48:51 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux martin@ubuntu14:/tmp$ firejail --version firejail version 0.9.45 Compile time support: - AppArmor support is disabled - AppImage support is enabled - bind support is enabled - chroot support is enabled - file and directory whitelisting support is enabled - file transfer support is enabled - networking support is enabled - overlayfs support is enabled - private-home support is enabled - seccomp-bpf support is enabled - user namespace support is enabled - X11 sandboxing support is enabled martin@ubuntu14:/tmp$ ls -l /etc/resolv.conf -rw-r--r--. 1 root root 45 Oct 27 08:35 /etc/resolv.conf martin@ubuntu14:/tmp$ firejail --chroot=/ Warning: default profile disabled by --chroot option Parent pid 13279, child pid 13280 Dropping all Linux capabilities and enforcing default seccomp filter Warning: failed to mount /sys Warning: whitelist feature is disabled in chroot Child process initialized martin@ubuntu14:/tmp$ ls -l /etc/resolv.conf -rw-r--r--. 1 root root 0 Oct 27 08:35 /etc/resolv.conf martin@ubuntu14:/tmp$ exit Parent is shutting down, bye... martin@ubuntu14:/tmp$ ls -l /etc/resolv.conf -rw-r--r--. 1 root root 0 Oct 27 08:35 /etc/resolv.conf martin@ubuntu14:/tmp$ ```

gitea-mirror

2026-05-05 06:14:33 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 06:14:40 -06:00

Author

Owner

@netblue30 commented on GitHub (Oct 27, 2016):

Security problem! I have fixed copy_file(), if the destination already exists it returns an error. I also put code in to reject --chroot=/. This is the commit: 6144229605. Thanks.

@netblue30 commented on GitHub (Oct 27, 2016): Security problem! I have fixed copy_file(), if the destination already exists it returns an error. I also put code in to reject --chroot=/. This is the commit: https://github.com/netblue30/firejail/commit/6144229605177764b7f3f3450c1a47f56595dc9e. Thanks.

gitea-mirror commented

2026-05-05 06:14:44 -06:00

Author

Owner

@mcarpenter commented on GitHub (Oct 27, 2016):

Thanks!

@mcarpenter commented on GitHub (Oct 27, 2016): Thanks!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#594

No description provided.

Rows
Columns