{"action":"opened","issue":{"url":"https://api.github.com/repos/netblue30/firejail/issues/744","repository_url":"https://api.github.com/repos/netblue30/firejail","labels_url":"https://api.github.com/repos/netblue30/firejail/issues/744/labels{/name}","comments_url":"https://api.github.com/repos/netblue30/firejail/issues/744/comments","events_url":"https://api.github.com/repos/netblue30/firejail/issues/744/events","html_url":"https://github.com/netblue30/firejail/issues/744","id":173100613,"number":744,"title":"blacklisting a symbolic link causes firejail to fail on jessie/armhf","user":{"login":"tdaitx","id":743143,"avatar_url":"https://avatars.githubusercontent.com/u/743143?v=3","gravatar_id":"","url":"https://api.github.com/users/tdaitx","html_url":"https://github.com/tdaitx","followers_url":"https://api.github.com/users/tdaitx/followers","following_url":"https://api.github.com/users/tdaitx/following{/other_user}","gists_url":"https://api.github.com/users/tdaitx/gists{/gist_id}","starred_url":"https://api.github.com/users/tdaitx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tdaitx/subscriptions","organizations_url":"https://api.github.com/users/tdaitx/orgs","repos_url":"https://api.github.com/users/tdaitx/repos","events_url":"https://api.github.com/users/tdaitx/events{/privacy}","received_events_url":"https://api.github.com/users/tdaitx/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-25T02:28:15Z","updated_at":"2016-08-25T02:28:15Z","closed_at":null,"body":"Debian jessie has a lot of symbolic links to gcc programs in /usr/bin (eg. gcc -> gcc-4.9) and that makes firejail fail with the message  `Error: cannot establish communication with the parent, exiting...`\r\n\r\nA simple testcase to reproduce the issue:\r\n```\r\n$ ls -l deadbeef*\r\n-rw-r--r-- 1 user user  0 Aug 24 23:02 deadbeef\r\nlrwxrwxrwx 1 user user 34 Aug 24 23:02 deadbeef.link -> deadbeef\r\n```\r\n\r\nlink-test.profile contains:\r\n```\r\nblacklist ${HOME}/deadbeef.link\r\n```\r\n\r\nIt will fail as:\r\n\r\n```\r\n$ firejail --debug --profile=/etc/firejail/link-test.profile \r\nReading profile /etc/firejail/000.profile\r\nCommand name #bash#\r\nUsing the local network stack\r\nParent pid 3541, child pid 3542\r\nInitializing child process\r\nHost network configured\r\nPID namespace installed\r\nMounting tmpfs on /run/firejail/mnt directory\r\nMounting read-only /bin, /sbin, /lib, /lib32, /lib64, /usr, /etc, /var\r\nMounting tmpfs on /var/lock\r\nMounting tmpfs on /var/tmp\r\nMounting tmpfs on /var/log\r\nMounting tmpfs on /var/lib/dhcp\r\nCreate the new utmp file\r\nMount the new utmp file\r\nCleaning /home directory\r\nSanitizing /etc/passwd\r\nSanitizing /etc/group\r\nDisable /etc/firejail\r\nDisable /run/firejail/network\r\nDisable /run/firejail/bandwidth\r\nDisable /run/firejail/name\r\nDisable /run/firejail/x11\r\nError: cannot establish communication with the parent, exiting...\r\n```\r\n\r\nUsing a blacklist mask causes the same error:\r\n```\r\nblacklist ${HOME}/deadbeef*\r\n```\r\n\r\nTrying to whitelist the real file as bellow does not help at all:\r\n```\r\nnoblacklist ${HOME}/deadbeef\r\nblacklist ${HOME}/deadbeef.link\r\n```\r\n\r\nUsing the overlay does not help as well.\r\n\r\nSystem information:\r\n```\r\n$ lsb_release -a\r\nNo LSB modules are available.\r\nDistributor ID:\tDebian\r\nDescription:\tDebian GNU/Linux 8.5 (jessie)\r\nRelease:\t8.5\r\nCodename:\tjessie\r\n```\r\n\r\n```\r\ncat /proc/cpuinfo\r\nprocessor\t: 0\r\nmodel name\t: ARMv7 Processor rev 4 (v7l)\r\nBogoMIPS\t: 37.89\r\nFeatures\t: half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm \r\nCPU implementer\t: 0x41\r\nCPU architecture: 7\r\nCPU variant\t: 0x0\r\nCPU part\t: 0xc07\r\nCPU revision\t: 4\r\n\r\nprocessor\t: 1\r\nmodel name\t: ARMv7 Processor rev 4 (v7l)\r\nBogoMIPS\t: 37.89\r\nFeatures\t: half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm \r\nCPU implementer\t: 0x41\r\nCPU architecture: 7\r\nCPU variant\t: 0x0\r\nCPU part\t: 0xc07\r\nCPU revision\t: 4\r\n\r\nHardware\t: Allwinner sun7i (A20) Family\r\nRevision\t: 0000\r\nSerial\t\t: 16516603070355cc\r\n```\r\n\r\nFirejail package version on jessie: 0.9.40-3~bpo8+\r\n\r\n\r\nNote: the same test works just fine on adm64 with the package version 0.9.38-1.\r\n\r\nPlease let me know how else I can help."}}
{"actor":{"display_login":"tdaitx"}}