1

I'm trying to use firejail (version 0.9.58.2) for application sandboxing on my Debian Stable machine. From what I understand it's possible to create a custom configuration file for each application but I wasn't successful in doing so.

Currently I'm trying to write a custom man.profile-file, since it sounds quite easy. I put a file with the following content in my ~/.config/firejail/-directory:

noblacklist /usr/share/man/
noblacklist /usr/lib/man-db/

include whitelist-var-common.inc

seccomp
shell none

private-bin sed,less,man,groff,nroff,tbl,bash
private-dev

But when I run man less, my pager opens only with an empty page and after closing I can read following error message:

Reading profile /home/$USER/.config/firejail/man.profile
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 42020, child pid 42045
7 programs installed in 10.65 ms
Child process initialized in 10.69 ms
/usr/bin/man: command exited with status 255: (cd /usr/share/man && /usr/lib/man-db/zsoelim) | (cd /usr/share/man && /usr/lib/man-db/manconv -f UTF-8:ISO-8859-1 -t ISO-8859-1//IGNORE) | (cd /usr/share/man && tbl) | (cd /usr/share/man && nroff -mandoc -rLL=189n -rLT=189n -Tutf8)

What am I doing wrong? Any ideas/pointers are appreciated!


Update (thanks @@artem-s-tashkinov): when running strace -f -e file -o /tmp/man.log man less (after first performing sudo firecfg --clean) and examining the output of /tmp/man.log I found that several other files were read while invoking man less. Therefore I updated the lines starting with private-bin and private-lib to include the following:

private-bin sed,less,man,groff,nroff,tbl,bash,terminfo,locale
private-lib /usr/lib/man-db,/usr/share/groff,/usr/share/locale,/usr/share/terminfo,/usr/share/man,/usr/lib/x86_64-linux-gnu,/lib/x86_64-linux-gnu,/usr/lib/charset.alias,/etc/ld.so.preload,/etc/ld.so.cache,/etc/manpath.config,/etc/suid-debug,/etc/terminfo,/etc/sysless,/etc/localtime

But the result is still negative: man less yields the following error:

bin/bash: error while loading shared libraries: libtinfo.so.6: cannot open shared object file: No such file or directory                                                                        
/usr/bin/man: command exited with status 127: (cd /usr/share/man && /usr/lib/man-db/zsoelim) | (cd /usr/share/man && /usr/lib/man-db/manconv -f UTF-8:ISO-8859-1 -t UTF-8//IGNORE) | (cd /usr/share/man && preconv -e UTF-8) | (cd /usr/share/man && tbl) | (cd /usr/share/man && nroff -mandoc -rLL=189n -rLT=189n -Tutf8)                                                                        

When looking for the location of libtinfo.so.6 using find /lib -name "*libtinfo*" the result is in /lib/x86_64-linux-gnu/, which is included in the private-lib-line.

And when eliminating the lines starting with private-bin and private-lib, it works (but obviously without the additional sandboxing).

1

Run it via strace -fF -e file -o /tmp/man.log man less first to see which extra directories you need to include for the command to work under firejail.

At least on my Fedora 32 these additional directories are required:

  • /usr/share/groff
  • /usr/share/locale - this one is probably already included by whitelist-var-common.inc
  • /usr/share/terminfo
5
  • @artem-s-tashkinov: thanks for the fast reply! I included the following line to my man.profile: private-lib /usr/share/groff,/usr/share/locale,/usr/share/terminfo but now I get a WARNING: terminal is not fully functional and it still only outputs an empty page. – n0542344 Oct 28 '20 at 19:29
  • 1
    A debian patch says these command currently don't work under firejail: sources.debian.org/patches/firejail/0.9.64-1/… Or maybe you haven't whitelisted all the required directories. – Artem S. Tashkinov Oct 28 '20 at 19:33
  • @artem-s-tashkinov: well, that's a pity... I just figured out that I could run it without the private-bin ...-part of the file. This defeats (partially) the sandboxing-idea, but it's a better option than not using firejail at all. – n0542344 Oct 28 '20 at 19:38
  • @artem-s-tashkinov: by the way: strace outputs strace: deprecated option -F ignored. – n0542344 Oct 28 '20 at 19:40
  • Old habits never die :-) – Artem S. Tashkinov Oct 29 '20 at 12:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.