github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #972] security profile is being read twice under certain circumstances #661

New issue

Closed

opened 2026-05-05 06:23:42 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 06:23:42 -06:00

Owner

Originally created by @djfd on GitHub (Dec 12, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/972

Hi,

loading app with --x11=xpra and implicit --profile specification causes double reading (and applying) security profile

perhaps for a double security ))

Reading profile /etc/firejail/skype.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-devel.inc
Warning: user namespaces not available in the current kernel.

X.Org X Server 1.18.4
Release Date: 2016-07-19
X Protocol Version 11, Revision 0
Build Operating System: Linux 4.5.4-1-ARCH x86_64 
Current Operating System: Linux my-arch 4.8.12-3-ARCH #1 SMP PREEMPT Thu Dec 8 16:10:23 CET 2016 x86_64
Kernel command line: BOOT_IMAGE=/boot/vmlinuz-linux root=UUID=7105681b-2785-4974-9405-0d7b7bd3545f rw quiet resume=PARTUUID=9cd9da86-1642-4590-bc0c-dac5fff0af72
Build Date: 19 July 2016  05:54:24PM
 
Current version of pixman: 0.34.0
	Before reporting problems, check http://wiki.x.org
	to make sure that you have the latest version.
Markers: (--) probed, (**) from config file, (==) default setting,
	(++) from command line, (!!) notice, (II) informational,
	(WW) warning, (EE) error, (NI) not implemented, (??) unknown.
(++) Log file: "/home/aa/.xpra/Xorg.:367.log", Time: Tue Dec 13 04:56:34 2016
(++) Using config file: "/etc/xpra/xorg.conf"
(==) Using system config directory "/usr/share/X11/xorg.conf.d"
2016-12-13 04:56:35,021 created unix domain socket: /home/aa/.xpra/my-arch-367
Reading profile /etc/firejail/skype.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-devel.inc
...
Disable /usr/bin/umount
Disable /usr/bin/umount
Disable /usr/bin/umount
Disable /usr/bin/umount
Disable /usr/bin/mount
Disable /usr/bin/mount
Disable /usr/bin/mount
Disable /usr/bin/mount
Disable /usr/bin/fusermount
Disable /usr/bin/fusermount
Disable /usr/bin/fusermount
Disable /usr/bin/fusermount
...

there is a command line to reproduce

firejail --private-home=@~/.Skype --profile=/etc/firejail/skype.profile --x11=xpra --shell=none --debug xterm 2>&1 |tee .dup-profile.log

Originally created by @djfd on GitHub (Dec 12, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/972 Hi, loading app with ```--x11=xpra``` and implicit ```--profile``` specification causes double reading (and applying) security profile perhaps for a double security )) ``` Reading profile /etc/firejail/skype.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-devel.inc Warning: user namespaces not available in the current kernel. X.Org X Server 1.18.4 Release Date: 2016-07-19 X Protocol Version 11, Revision 0 Build Operating System: Linux 4.5.4-1-ARCH x86_64 Current Operating System: Linux my-arch 4.8.12-3-ARCH #1 SMP PREEMPT Thu Dec 8 16:10:23 CET 2016 x86_64 Kernel command line: BOOT_IMAGE=/boot/vmlinuz-linux root=UUID=7105681b-2785-4974-9405-0d7b7bd3545f rw quiet resume=PARTUUID=9cd9da86-1642-4590-bc0c-dac5fff0af72 Build Date: 19 July 2016 05:54:24PM Current version of pixman: 0.34.0 Before reporting problems, check http://wiki.x.org to make sure that you have the latest version. Markers: (--) probed, (**) from config file, (==) default setting, (++) from command line, (!!) notice, (II) informational, (WW) warning, (EE) error, (NI) not implemented, (??) unknown. (++) Log file: "/home/aa/.xpra/Xorg.:367.log", Time: Tue Dec 13 04:56:34 2016 (++) Using config file: "/etc/xpra/xorg.conf" (==) Using system config directory "/usr/share/X11/xorg.conf.d" 2016-12-13 04:56:35,021 created unix domain socket: /home/aa/.xpra/my-arch-367 Reading profile /etc/firejail/skype.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-devel.inc ... Disable /usr/bin/umount Disable /usr/bin/umount Disable /usr/bin/umount Disable /usr/bin/umount Disable /usr/bin/mount Disable /usr/bin/mount Disable /usr/bin/mount Disable /usr/bin/mount Disable /usr/bin/fusermount Disable /usr/bin/fusermount Disable /usr/bin/fusermount Disable /usr/bin/fusermount ... ``` there is a command line to reproduce ``` firejail --private-home=@~/.Skype --profile=/etc/firejail/skype.profile --x11=xpra --shell=none --debug xterm 2>&1 |tee .dup-profile.log ```

gitea-mirror

2026-05-05 06:23:42 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 06:23:47 -06:00

Author

Owner

@netblue30 commented on GitHub (Dec 13, 2016):

The first reading just loads the profile into memory, it doesn't process it. I'll disable the reading.

@netblue30 commented on GitHub (Dec 13, 2016): The first reading just loads the profile into memory, it doesn't process it. I'll disable the reading.

gitea-mirror commented

2026-05-05 06:23:50 -06:00

Author

Owner

@djfd commented on GitHub (Dec 13, 2016):

hmm, not applied you say...

did you see that all disables are done 4x times? why is that then?

yet another question. how do xpra client/server launched? with or without sandbox? is there any security threats if/when started as regular user?

I noticed that there is some dbus magic in xpra, can this be used eg. to escape from the sandbox if client/server are both trusted?

@djfd commented on GitHub (Dec 13, 2016): hmm, not applied you say... did you see that all disables are done 4x times? why is that then? yet another question. how do xpra client/server launched? with or without sandbox? is there any security threats if/when started as regular user? I noticed that there is some dbus magic in xpra, can this be used eg. to escape from the sandbox if client/server are both trusted?

gitea-mirror commented

2026-05-05 06:23:53 -06:00

Author

Owner

@pyamsoft commented on GitHub (Dec 19, 2016):

Because you are on Arch, every binary location, /usr/sbin, /bin, and /sbin are symlinked to /usr/bin.

firejail still processes these locations, but only actually disables the real binary located in /usr/bin.

@pyamsoft commented on GitHub (Dec 19, 2016): Because you are on Arch, every binary location, /usr/sbin, /bin, and /sbin are symlinked to /usr/bin. firejail still processes these locations, but only actually disables the real binary located in /usr/bin.

gitea-mirror commented

2026-05-05 06:23:55 -06:00

Author

Owner

@djfd commented on GitHub (Dec 19, 2016):

yeah, I know

But it is at least confusing, is not it? I really dislike to see that my /bin directory is being protected 4x(!) times...

I agreed, it is just small cosmetic issue, but it is here...

Until the bug is documented it is a bug, after being documented it is a feature. Do you feel a difference?

@djfd commented on GitHub (Dec 19, 2016): yeah, I know But it is at least confusing, is not it? I really dislike to see that my /bin directory is being protected 4x(!) times... I agreed, it is just small cosmetic issue, but it is here... Until the bug is documented it is a bug, after being documented it is a feature. Do you feel a difference?

gitea-mirror commented

2026-05-05 06:23:58 -06:00

Author

Owner

@pyamsoft commented on GitHub (Dec 19, 2016):

Yes I agree with you it can be confusing. I just wanted to convey that, due to the set up of your system, it was purely a cosmetic issue you were experiencing, and should not affect the security of firejail itself.

@pyamsoft commented on GitHub (Dec 19, 2016): Yes I agree with you it can be confusing. I just wanted to convey that, due to the set up of your system, it was purely a cosmetic issue you were experiencing, and should not affect the security of firejail itself.

gitea-mirror commented

2026-05-05 06:24:00 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 30, 2018):

Seems to be fixed in the current version (it still lists things twice since /bin -> /usr/bin on my system, but it describes why it's listed the second time).

@chiraag-nataraj commented on GitHub (Jul 30, 2018): Seems to be fixed in the current version (it still lists things twice since `/bin -> /usr/bin` on my system, but it describes _why_ it's listed the second time).

gitea-mirror referenced this issue

2026-05-05 10:06:23 -06:00

[PR #661] [MERGED] Fix command line quoting on joining, move quoting code to functions #3705

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#661

No description provided.

Rows
Columns