mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #1321] keepassx segfault #903
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#903
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @8cc on GitHub (May 30, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1321
Fedora 25 KDE spins, firejail 0.9.44.10 (copr nielsenb/firejail), keepassx 2.0.3.
When try to select a file, segfault.
dmesg
[199975.701777] keepassx[5132]: segfault at 0 ip 00007f2fead15a09 sp 00007ffdb9aecad0 error 4 in libkio.so.5.14.30[7f2feab26000+2b4000]@netblue30 commented on GitHub (May 30, 2017):
In a text editor open /etc/firejail/kepassx.profile and change "protocol unix" in "protocol unix,inet,inet6". Let me know if is working.
@8cc commented on GitHub (May 30, 2017):
It's not working. Problem persists.
@netblue30 commented on GitHub (May 30, 2017):
I think is "net none" in the same file - comment it out. Somehow I missed it!
@8cc commented on GitHub (May 30, 2017):
Comment to "net none" could not help, problem persists.
@Fred-Barclay commented on GitHub (May 31, 2017):
@8cc Is the latest version of firejail (0.9.46) available for your distro?
On 05/30/2017 05:14 PM, 8cc wrote:
@8cc commented on GitHub (May 31, 2017):
Firejail is available in third-party repositories from the community, but I do not see the latest version. There is also a binary .rpm package with the latest version here: https://sourceforge.net/projects/firejail/files/firejail/ But it seemed to me that the problem is in configs, and the new version is not so much needed.
@Fred-Barclay commented on GitHub (May 31, 2017):
Hi @8cc,
Go with the binary .rpm from
https://sourceforge.net/projects/firejail/files/firejail/ please, then
see if the problem still exists.
On 05/31/2017 01:24 AM, 8cc wrote:
@8cc commented on GitHub (May 31, 2017):
Updated to the latest version through the .rpm , now the keepassx does not start. Tried to change configs, does not help.
@Fred-Barclay commented on GitHub (May 31, 2017):
@8cc let me make sure I understand the problem correctly:
Is this correct?
Can you post the exact keepassx profile you are using?
Can you run the following and post the output:
firejail --debug keepassx?@8cc commented on GitHub (May 31, 2017):
Yes, that right.
I use default configuration in nielsenb/firejail:
firejail --debug keepassx
and tried to select a file.
https://gist.github.com/8cc/bbee4754f8b12e0b6a777e29f5ce3c73
@Fred-Barclay commented on GitHub (Jun 1, 2017):
Try commenting out
private-bin keepassxCan you help me understand what this Ksyscoca is that keeps being referenced in the error message? I can't find it in the Fedora package database https://admin.fedoraproject.org/pkgdb/packages/KSycoca%2A/
The best I can tell it was dropped after KDE 3, though it's still in the Trinity DE.
@8cc commented on GitHub (Jun 1, 2017):
Сomment
private-bin keepassxnot help.KDE SYstem COnfiguration CAche.
@Anyon3 commented on GitHub (Jun 1, 2017):
Try with firejail in command line without a defined profile
firejail --machine-id --noprofile --nonewprivs --noroot --caps.drop=all --nosound --private-dev --seccomp --no3d --private-tmp --nogroups --net=none keepassx
Hope it's help
@8cc commented on GitHub (Jun 1, 2017):
firejail --machine-id --noprofile --nonewprivs --noroot --caps.drop=all --nosound --private-dev --seccomp --no3d --private-tmp --nogroups --net=none keepassxKeepassx started, the file selection dialog appeared, but when try to select: "The specified folder does not exist or was not readable." Perhaps this is not the fault of the firejail.
@Anyon3 commented on GitHub (Jun 1, 2017):
Try to remove the argument --nogroups and --nonewprivs (nonewprivs is not required when --seccomp is passed)
If it's still the same, give a try to keepassxc
@8cc commented on GitHub (Jun 1, 2017):
Works! Files are selected when not
--private. (I added it for some reason)@Anyon3 commented on GitHub (Jun 1, 2017):
you could maybe try to add a directory inside your /home/$user/ like keepassxjail and add --private=~/keepassxjail/ (don't forget to place your kdbx database inside keepassxjail) to increase the security.
@netblue30 commented on GitHub (Jun 1, 2017):
What bothers me is you have a password manager crashed by the sandbox when it tries to connect to the network. Why would a password manager try to connect to the network?
Also, make sure you run 0.9.46. In this version a lot of fixes went in for all keepass utilities. You can get an .rpm package from our download page, it was build on CentOS 7, it should work fine on any Fedora distro released after that.
@Anyon3 commented on GitHub (Jun 1, 2017):
Looking at the dmesg output, could https://en.wikipedia.org/wiki/KIO explain the connection of his keepassx over the network ?
@Fred-Barclay commented on GitHub (Jun 1, 2017):
I'm not sure that it's crashed when trying to connect to the network. I get the exact same output on Debian Sid MATE and keepassx works fine in firejail:
@Fred-Barclay commented on GitHub (Jun 2, 2017):
I might have a fix in. On a Fedora 25 Gnome VM, keepassx would crash in firejail if
private-bindid not contain both keepassx and keepassx2, or if it couldn't read /etc/machine-id (which we've been blocking withprivate-etc fonts). I've added keepassx2 to private-bin, and added /etc/machine-id to the sandbox... but it's spoofed with themachine-idoption so keepassx still can't see your real machine id. 😁@8cc Can you try the new profile? It's at https://raw.githubusercontent.com/netblue30/firejail/3a2428bd4ba70e4b4c71b8e7ae7aeee8e027428e/etc/keepassx.profile
@8cc commented on GitHub (Jun 3, 2017):
Profile did not help, firejail 0.9.46.
@Anyon3 commented on GitHub (Jun 3, 2017):
I tried the keepassx profile proposed by Fred-Barclay on my Gentoo Hardened and got this
keepassx: error while loading shared libraries: libQtCore.so.4: cannot open shared object file: No such file or directory
I added a comment to
private-etc fonts,machine-id
And this fixed the error. Another small thing I spotted is the use of nonewprivs, I may be wrong but according to the man firejail
This option is enabled by default if seccomp filter is activated
As seccomp is passed in the profile, nonewprivs can be removed ?
Firejail 0.9.47
KeepassX 2.0.2-r1
@netblue30 commented on GitHub (Jun 4, 2017):
Yes, you can remove it. However, if you remove seccomp, it is a very good idea to bring back nonewprivs.
@Anyon3 commented on GitHub (Jun 5, 2017):
Ok thanks for this infos. Most of the profile have nonewprivs and seccomp, this is in case seccomp is not active on the system Linux right ?
@netblue30 commented on GitHub (Jun 10, 2017):
Seccomp and nonewprivs are not enabled by default on any Linux system. Seccomp configuration is very specific to the particular program running.
@Tanath commented on GitHub (Jan 22, 2018):
I was getting this issue until I commented out
memory-deny-write-execute.