github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #888] "firejail --get" always fails #603

New issue

Closed

opened 2026-05-05 06:15:40 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 06:15:40 -06:00

Owner

Originally created by @mcarpenter on GitHub (Nov 1, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/888

sandboxfs() tries to create the destination file as unprivileged user at https://github.com/netblue30/firejail/blob/master/src/firejail/ls.c#L388

On success, it does not delete the resulting file. Subsequently copy_file chokes since the target already exists: https://github.com/netblue30/firejail/blob/master/src/firejail/util.c#L195

firejail --get therefore always fails:

martin@ubuntu14:/tmp$ rm passwd
rm: cannot remove ‘passwd’: No such file or directory
martin@ubuntu14:/tmp$ firejail --name=foo --noprofile sleep 60 &
[1] 30487
martin@ubuntu14:/tmp$ Parent pid 30487, child pid 30488
Warning: failed to mount /sys
Child process initialized

martin@ubuntu14:/tmp$ firejail --get=foo /etc/passwd
Error: file passwd already exists
Error: transfer failed
martin@ubuntu14:/tmp$

That's an easily fixable bug but less TOCTOU would be good, generally, throughout. Specifically copy_file should know what rights it has to read/write the source/destination files -- these abilities shouldn't be tested aforetime and then copy_file given free reign via EUID_ROOT.

Originally created by @mcarpenter on GitHub (Nov 1, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/888 `sandboxfs()` tries to create the destination file as unprivileged user at https://github.com/netblue30/firejail/blob/master/src/firejail/ls.c#L388 On success, it does not delete the resulting file. Subsequently `copy_file` chokes since the target already exists: https://github.com/netblue30/firejail/blob/master/src/firejail/util.c#L195 `firejail --get` therefore always fails: martin@ubuntu14:/tmp$ rm passwd rm: cannot remove ‘passwd’: No such file or directory martin@ubuntu14:/tmp$ firejail --name=foo --noprofile sleep 60 & [1] 30487 martin@ubuntu14:/tmp$ Parent pid 30487, child pid 30488 Warning: failed to mount /sys Child process initialized martin@ubuntu14:/tmp$ firejail --get=foo /etc/passwd Error: file passwd already exists Error: transfer failed martin@ubuntu14:/tmp$ That's an easily fixable bug but less TOCTOU would be good, generally, throughout. Specifically `copy_file` should know what rights it has to read/write the source/destination files -- these abilities shouldn't be tested aforetime and then `copy_file` given free reign via `EUID_ROOT`.

gitea-mirror

2026-05-05 06:15:40 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 06:15:48 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 2, 2016):

I have a fix for --get/--put/TOCTOU problem on 0.9.44-bugfixes branch. I will be releasing it as 0.9.44.2 in the next two weeks - there are more security fixes to go in there. I'll close this bug after I look into copy_file and I merge the bugfix branch on main. Thanks.

@netblue30 commented on GitHub (Nov 2, 2016): I have a fix for --get/--put/TOCTOU problem on 0.9.44-bugfixes branch. I will be releasing it as 0.9.44.2 in the next two weeks - there are more security fixes to go in there. I'll close this bug after I look into copy_file and I merge the bugfix branch on main. Thanks.

gitea-mirror commented

2026-05-05 06:15:51 -06:00

Author

Owner

@mcarpenter commented on GitHub (Mar 23, 2017):

I just tested 0.9.45, and this is fixed. Thanks!

@mcarpenter commented on GitHub (Mar 23, 2017): I just tested 0.9.45, and this is fixed. Thanks!

gitea-mirror referenced this issue

2026-05-05 10:05:58 -06:00

[PR #603] [MERGED] fix some typos #3682

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#603

No description provided.

Rows
Columns