mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #1176] Firejail app cannot communicate with my Yubikey #809
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#809
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ghost on GitHub (Mar 29, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1176
I'm currently testing a new app with firejail that needs to access my Yubikee (connected in a USB port) but cannot see it inside a jail.
Is there a option I could add (or remove) to the app profile that will most likely give access to the Yubikey?
Thank you!
@Fred-Barclay commented on GitHub (Mar 29, 2017):
@BytesTuner
Could you post the app profile you are currently using?
Thanks!
@ghost commented on GitHub (Mar 29, 2017):
The app I'm testing is the current git version of KeepassXC (the new and most active fork of KeepassX):
https://github.com/keepassxreboot/keepassxc
...and the profile I'm using with it is the default Firejail KeepassX (I obviously customize it with the right keepassxc directory):
https://github.com/netblue30/firejail/blob/master/etc/keepassx.profile
KeepassXC is working fine with this profile and the custom path but it cannot see the Yubikey (which the app is able to see without the jail).
@chiraag-nataraj commented on GitHub (Mar 29, 2017):
The problem is probably the
private-devoption. You'll want towhitelist(ornoblacklistor something) the appropriate device in/devto ensure KeepassXC sees the yubikey.@ghost commented on GitHub (Mar 29, 2017):
OK, I done some more tests and the culprits were:
protocol unix
private-dev
This is my working final profile for keepassxc:
noblacklist ${HOME}/.config/keepassxc
noblacklist ${HOME}/.keepassxc
noblacklist ${HOME}/.kdbx
noblacklist ${HOME}/.kdb
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc
caps.drop all
net none
nogroups
nonewprivs
noroot
nosound
#protocol unix
seccomp
shell none
private-bin keepassxc
#private-etc fonts
#private-dev
private-tmp
I obviously don't mind if someone wants to add it to this git.
Important thing:
The 'net none' option should be comment out if someone needs to use their new KeePassHTTP support for use with PassIFox in Mozilla Firefox and chromeIPass in Google Chrome or Chromium. In my case, I don't use it so I leave it uncommented.
@Fred-Barclay commented on GitHub (Mar 30, 2017):
@BytesTuner I've added the profile, thanks!
5a982a1e5eCurrently private-dev and protocol unix are commented out. I or someone else might change this later (I'm not sure it's a good idea to disable this for all users - we don't for the other keypass profiles). If so, you can just copy the profile to ~/.config/firejail and comment out/remove those two lines.
Cheers and thanks for the profile!
Fred
@ghost commented on GitHub (Mar 30, 2017):
It basically all depends which new KeepassXC features the user wants to use. The more secure option is to not commented them out. The basic features of KeepassXC will work this way.
However, some options must be commented out if the user wants to use the new features:
To use KeePassHTTP -> 'net none' must be commented out
To use YubiKey HMAC-SHA1 authentication for unlocking databases -> 'protocol unix' and 'private-dev' must be commented out. If not, the app won't see the Yubikey connected on the computer.
I don't know but maybe it could be a good thing to add this information directly in the profile file...?
No problem. You're welcome! :)
@Fred-Barclay commented on GitHub (Mar 30, 2017):
Good idea - I've added a note for KeePassHTTP.
For YubiKey, that's more of a general firejail knowledge issue than with the keepassxc profile (private-dev should interfere with usb keys in any profile) but it's definitely good to know for future reference.
Cheers!
@Fred-Barclay commented on GitHub (Mar 30, 2017):
@chiraag-nataraj Thanks for the help too! 👍
@chiraag-nataraj commented on GitHub (Mar 30, 2017):
Hehe glad to see you sorted it out! 😄
@arigit commented on GitHub (Oct 5, 2017):
In Fedora 26 under wayland, the following two options didn't work:
--noroot
--private-tmp
--nosound
"No root" gives an error ("invalid --noroot command line option" even if not launching as root)
Private-tmp seems to have an issue with wayland, it gives:
QXcbConnection: Could not connect to display :0
nosound blocks keepassxc from seeing Yubikeys
If launching via command line, this can help:
firejail --profile=/etc/firejail/disable-common.inc --net=none --caps.drop=all --nogroups --nonewprivs --seccomp --shell=none --private-bin=keepassxc keepassxc -style adwaita-dark@Fred-Barclay commented on GitHub (Oct 6, 2017):
@arigit disable-common.inc isn't meant to be used as a profile. We use it to blacklist common files that shouldn't be visible inside the sandbox. It would probably be better to use the keepassxc profile (in which case you won't have to specify a profile on the command line - firejail will know to use the keepassxc profile since you're launching keepassxc), or the default profile, which you can specify with
--profile=/etc/firejail/default.profile.Cheers!