[GH-ISSUE #126] With v. 0.9.34 services don't start anymore

gitea-mirror commented

2026-05-05 05:00:04 -06:00

Owner

Originally created by @curiosity-seeker on GitHub (Nov 9, 2015).
Original GitHub issue: https://github.com/netblue30/firejail/issues/126

I have unbound and dnscrypt-proxy sandboxed with Firejail. Unfortunately, with v. 0.9.34 those services don't start anymore with my old self-made profile. But even with the default server.profile it doesn't work. Example:

dnscrypt-proxy.service - DNSCrypt client proxy
   Loaded: loaded (/usr/lib/systemd/system/dnscrypt-proxy.service; enabled; vendor preset: disabled)
  Drop-In: /etc/systemd/system/dnscrypt-proxy.service.d
           └─override.conf
   Active: inactive (dead) since Mo 2015-11-09 14:56:15 CET; 9s ago
  Process: 9259 ExecStart=/usr/bin/firejail --profile=/etc/firejail/server.profile /usr/bin/dnscrypt-proxy --ephemeral-keys --resolver-name=dnscrypt.eu-nl --local-address=127.0.0.1:40 --user=nobody (code=exited, status=0/SUCCESS)
 Main PID: 9259 (code=exited, status=0/SUCCESS)

Nov 09 14:56:15 hannibal firejail[9259]: Reading profile /etc/firejail/disable-mgmt.inc
Nov 09 14:56:15 hannibal firejail[9259]: [INFO] + DNS Security Extensions are supported
Nov 09 14:56:15 hannibal firejail[9259]: [INFO] - [dnscrypt.eu-nl] does not support Namecoin domains
Nov 09 14:56:15 hannibal firejail[9259]: [INFO] + Provider supposedly doesn't keep logs
Nov 09 14:56:15 hannibal firejail[9259]: [NOTICE] Starting dnscrypt-proxy 1.6.0
Nov 09 14:56:15 hannibal firejail[9259]: [INFO] Ephemeral keys enabled - generating a new seed
Nov 09 14:56:15 hannibal firejail[9259]: [INFO] Done
Nov 09 14:56:15 hannibal firejail[9259]: Parent pid 9259, child pid 9260
Nov 09 14:56:15 hannibal firejail[9259]: The new log directory is /proc/9260/root/var/log
Nov 09 14:56:15 hannibal firejail[9259]: parent is shutting down, bye...

And for unbound:

unbound.service - Unbound DNS Resolver
   Loaded: loaded (/usr/lib/systemd/system/unbound.service; enabled; vendor preset: disabled)
  Drop-In: /etc/systemd/system/unbound.service.d
           └─override.conf
   Active: failed (Result: start-limit) since Mo 2015-11-09 15:05:13 CET; 3s ago
  Process: 12103 ExecStart=/usr/bin/firejail --profile=/etc/firejail/server.profile /usr/bin/unbound -d (code=exited, status=0/SUCCESS)
  Process: 12101 ExecStartPre=/bin/cp -f /etc/trusted-key.key /etc/unbound/ (code=exited, status=0/SUCCESS)
 Main PID: 12103 (code=exited, status=0/SUCCESS)

Nov 09 15:05:13 hannibal systemd[1]: unbound.service: Service hold-off time over, scheduling restart.
Nov 09 15:05:13 hannibal systemd[1]: Stopped Unbound DNS Resolver.
Nov 09 15:05:13 hannibal systemd[1]: unbound.service: Start request repeated too quickly.
Nov 09 15:05:13 hannibal systemd[1]: Failed to start Unbound DNS Resolver.
Nov 09 15:05:13 hannibal systemd[1]: unbound.service: Unit entered failed state.
Nov 09 15:05:13 hannibal systemd[1]: unbound.service: Failed with result 'start-limit'.

Both services start normally once un-firejailed. So something has changed in v. 0.9.34 but I can't figure out what exactly.

Originally created by @curiosity-seeker on GitHub (Nov 9, 2015). Original GitHub issue: https://github.com/netblue30/firejail/issues/126 I have unbound and dnscrypt-proxy sandboxed with Firejail. Unfortunately, with v. 0.9.34 those services don't start anymore with my old self-made profile. But even with the default server.profile it doesn't work. Example: ``` dnscrypt-proxy.service - DNSCrypt client proxy Loaded: loaded (/usr/lib/systemd/system/dnscrypt-proxy.service; enabled; vendor preset: disabled) Drop-In: /etc/systemd/system/dnscrypt-proxy.service.d └─override.conf Active: inactive (dead) since Mo 2015-11-09 14:56:15 CET; 9s ago Process: 9259 ExecStart=/usr/bin/firejail --profile=/etc/firejail/server.profile /usr/bin/dnscrypt-proxy --ephemeral-keys --resolver-name=dnscrypt.eu-nl --local-address=127.0.0.1:40 --user=nobody (code=exited, status=0/SUCCESS) Main PID: 9259 (code=exited, status=0/SUCCESS) Nov 09 14:56:15 hannibal firejail[9259]: Reading profile /etc/firejail/disable-mgmt.inc Nov 09 14:56:15 hannibal firejail[9259]: [INFO] + DNS Security Extensions are supported Nov 09 14:56:15 hannibal firejail[9259]: [INFO] - [dnscrypt.eu-nl] does not support Namecoin domains Nov 09 14:56:15 hannibal firejail[9259]: [INFO] + Provider supposedly doesn't keep logs Nov 09 14:56:15 hannibal firejail[9259]: [NOTICE] Starting dnscrypt-proxy 1.6.0 Nov 09 14:56:15 hannibal firejail[9259]: [INFO] Ephemeral keys enabled - generating a new seed Nov 09 14:56:15 hannibal firejail[9259]: [INFO] Done Nov 09 14:56:15 hannibal firejail[9259]: Parent pid 9259, child pid 9260 Nov 09 14:56:15 hannibal firejail[9259]: The new log directory is /proc/9260/root/var/log Nov 09 14:56:15 hannibal firejail[9259]: parent is shutting down, bye... ``` And for unbound: ``` unbound.service - Unbound DNS Resolver Loaded: loaded (/usr/lib/systemd/system/unbound.service; enabled; vendor preset: disabled) Drop-In: /etc/systemd/system/unbound.service.d └─override.conf Active: failed (Result: start-limit) since Mo 2015-11-09 15:05:13 CET; 3s ago Process: 12103 ExecStart=/usr/bin/firejail --profile=/etc/firejail/server.profile /usr/bin/unbound -d (code=exited, status=0/SUCCESS) Process: 12101 ExecStartPre=/bin/cp -f /etc/trusted-key.key /etc/unbound/ (code=exited, status=0/SUCCESS) Main PID: 12103 (code=exited, status=0/SUCCESS) Nov 09 15:05:13 hannibal systemd[1]: unbound.service: Service hold-off time over, scheduling restart. Nov 09 15:05:13 hannibal systemd[1]: Stopped Unbound DNS Resolver. Nov 09 15:05:13 hannibal systemd[1]: unbound.service: Start request repeated too quickly. Nov 09 15:05:13 hannibal systemd[1]: Failed to start Unbound DNS Resolver. Nov 09 15:05:13 hannibal systemd[1]: unbound.service: Unit entered failed state. Nov 09 15:05:13 hannibal systemd[1]: unbound.service: Failed with result 'start-limit'. ``` Both services start normally once un-firejailed. So something has changed in v. 0.9.34 but I can't figure out what exactly.

gitea-mirror

2026-05-05 05:00:04 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 05:00:14 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 9, 2015):

My guess would be --private-dev. Can you please comment it out from server.profile? Thanks

@netblue30 commented on GitHub (Nov 9, 2015): My guess would be --private-dev. Can you please comment it out from server.profile? Thanks

gitea-mirror commented

2026-05-05 05:00:15 -06:00

Author

Owner

@curiosity-seeker commented on GitHub (Nov 9, 2015):

Okay, I tried that for dnscrypt-proxy but to no avail. I got the same systemctl status message as above.

@curiosity-seeker commented on GitHub (Nov 9, 2015): Okay, I tried that for dnscrypt-proxy but to no avail. I got the same systemctl status message as above.

gitea-mirror commented

2026-05-05 05:00:18 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 9, 2015):

What version did you have installed before 0.9.34?

@netblue30 commented on GitHub (Nov 9, 2015): What version did you have installed before 0.9.34?

gitea-mirror commented

2026-05-05 05:00:22 -06:00

Author

Owner

@curiosity-seeker commented on GitHub (Nov 9, 2015):

0.9.32

@curiosity-seeker commented on GitHub (Nov 9, 2015): 0.9.32

gitea-mirror commented

2026-05-05 05:00:25 -06:00

Author

Owner

@curiosity-seeker commented on GitHub (Nov 9, 2015):

And the same problem also for unbound with private-dev commented out.

@curiosity-seeker commented on GitHub (Nov 9, 2015): And the same problem also for unbound with private-dev commented out.

gitea-mirror commented

2026-05-05 05:00:29 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 9, 2015):

One problem found: I was missing /dev/log from private-dev. But this is not what crashes you.

@netblue30 commented on GitHub (Nov 9, 2015): One problem found: I was missing /dev/log from private-dev. But this is not what crashes you.

gitea-mirror commented

2026-05-05 05:00:33 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 10, 2015):

Found it!

The only thing that changed is seccomp. chroot syscall was added to the default list. In your profiles, replace "seccomp" line with "seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open" - it is the default list from man page without "chroot".

I've tested only unbound on Antergos (Arch). If it's working on your setup, I'll add default profiles for both unbound and dnscrypt-proxy

@netblue30 commented on GitHub (Nov 10, 2015): Found it! The only thing that changed is seccomp. chroot syscall was added to the default list. In your profiles, replace "seccomp" line with "seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open" - it is the default list from man page without "chroot". I've tested only unbound on Antergos (Arch). If it's working on your setup, I'll add default profiles for both unbound and dnscrypt-proxy

gitea-mirror commented

2026-05-05 05:00:36 -06:00

Author

Owner

@curiosity-seeker commented on GitHub (Nov 10, 2015):

Hurra! This really works - both for dnscrypt-proxy and unbound. And btw., private-dev is no problem here.

Thanks a lot, netblue30, you're my hero ;-)

@curiosity-seeker commented on GitHub (Nov 10, 2015): Hurra! This really works - both for dnscrypt-proxy and unbound. And btw., private-dev is no problem here. Thanks a lot, netblue30, you're my hero ;-)

gitea-mirror commented

2026-05-05 05:00:39 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 10, 2015):

I've noticed that log messages from unbound didn't go into syslog. It turned out private-dev didn't create a /dev/log entry in /dev directory - I've fixed it for the next version. I'll put default profiles in for unbound and dnscrypt-proxy , thanks for the bug!

@netblue30 commented on GitHub (Nov 10, 2015): I've noticed that log messages from unbound didn't go into syslog. It turned out private-dev didn't create a /dev/log entry in /dev directory - I've fixed it for the next version. I'll put default profiles in for unbound and dnscrypt-proxy , thanks for the bug!

Rows
Columns

[GH-ISSUE #126] With v. 0.9.34 services don't start anymore #82