{"action":"created","issue":{"url":"https://api.github.com/repos/netblue30/firejail/issues/2176","repository_url":"https://api.github.com/repos/netblue30/firejail","labels_url":"https://api.github.com/repos/netblue30/firejail/issues/2176/labels{/name}","comments_url":"https://api.github.com/repos/netblue30/firejail/issues/2176/comments","events_url":"https://api.github.com/repos/netblue30/firejail/issues/2176/events","html_url":"https://github.com/netblue30/firejail/issues/2176","id":369758122,"node_id":"MDU6SXNzdWUzNjk3NTgxMjI=","number":2176,"title":"sshd works within chroot, but not firejail chroot","user":{"login":"publicsite","id":34146156,"node_id":"MDQ6VXNlcjM0MTQ2MTU2","avatar_url":"https://avatars0.githubusercontent.com/u/34146156?v=4","gravatar_id":"","url":"https://api.github.com/users/publicsite","html_url":"https://github.com/publicsite","followers_url":"https://api.github.com/users/publicsite/followers","following_url":"https://api.github.com/users/publicsite/following{/other_user}","gists_url":"https://api.github.com/users/publicsite/gists{/gist_id}","starred_url":"https://api.github.com/users/publicsite/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/publicsite/subscriptions","organizations_url":"https://api.github.com/users/publicsite/orgs","repos_url":"https://api.github.com/users/publicsite/repos","events_url":"https://api.github.com/users/publicsite/events{/privacy}","received_events_url":"https://api.github.com/users/publicsite/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":17,"created_at":"2018-10-13T02:27:14Z","updated_at":"2018-10-15T20:53:54Z","closed_at":null,"author_association":"NONE","body":"Hello,\r\n\r\nsshd within a firejail chroot doesn't work, whereas using sshd within a coreutils chroot does. Any help with this would be very much appreciated!\r\n\r\n> #OpenSSH version (jail)\r\n> \r\n> OpenSSH_7.7p1, LibreSSL 2.7.4\r\n> \r\n> \r\n> #OpenSSH version (host)\r\n> \r\n> OpenSSH_7.2p2 Trisquel_GNU/Linux_8.0-1, OpenSSL 1.0.2g  1 Mar 2016\r\n> \r\n> \r\n> #firejail version\r\n> \r\n> firejail version 0.9.38.10\r\n> \r\n> \r\n> #firejail command\r\n> \r\n> sudo firejail --chroot=\"$PWD\"/jails/rootfs --shell=/bin/sh\r\n> \r\n> \r\n> #sshd command (within jail)\r\n> \r\n> /usr/sbin/sshd -E logfile.txt\r\n> \r\n> \r\n> #logfile.txt\r\n> \r\n> Server listening on 0.0.0.0 port 22.\r\n> Server listening on :: port 22.\r\n> \r\n> \r\n> #ssh command (host)\r\n> \r\n> ssh -vvv -T root@localhost\r\n> \r\n> \r\n> #ssh command (output)\r\n> \r\n> OpenSSH_7.2p2 Trisquel_GNU/Linux_8.0-1, OpenSSL 1.0.2g  1 Mar 2016\r\n> debug1: Reading configuration data /etc/ssh/ssh_config\r\n> debug1: /etc/ssh/ssh_config line 19: Applying options for *\r\n> debug2: resolving \"localhost\" port 22\r\n> debug2: ssh_connect_direct: needpriv 0\r\n> debug1: Connecting to localhost [127.0.0.1] port 22.\r\n> debug1: Connection established.\r\n> debug1: key_load_public: No such file or directory\r\n> debug1: identity file /home/user/.ssh/id_rsa type -1\r\n> debug1: key_load_public: No such file or directory\r\n> debug1: identity file /home/user/.ssh/id_rsa-cert type -1\r\n> debug1: key_load_public: No such file or directory\r\n> debug1: identity file /home/user/.ssh/id_dsa type -1\r\n> debug1: key_load_public: No such file or directory\r\n> debug1: identity file /home/user/.ssh/id_dsa-cert type -1\r\n> debug1: key_load_public: No such file or directory\r\n> debug1: identity file /home/user/.ssh/id_ecdsa type -1\r\n> debug1: key_load_public: No such file or directory\r\n> debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1\r\n> debug1: key_load_public: No such file or directory\r\n> debug1: identity file /home/user/.ssh/id_ed25519 type -1\r\n> debug1: key_load_public: No such file or directory\r\n> debug1: identity file /home/user/.ssh/id_ed25519-cert type -1\r\n> debug1: Enabling compatibility mode for protocol 2.0\r\n> debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Trisquel_GNU/Linux_8.0-1\r\n> debug1: Remote protocol version 2.0, remote software version OpenSSH_7.7\r\n> debug1: match: OpenSSH_7.7 pat OpenSSH* compat 0x04000000\r\n> debug2: fd 3 setting O_NONBLOCK\r\n> debug1: Authenticating to localhost:22 as 'root'\r\n> debug3: hostkeys_foreach: reading file \"/home/user/.ssh/known_hosts\"\r\n> debug3: send packet: type 20\r\n> debug1: SSH2_MSG_KEXINIT sent\r\n> Connection reset by 127.0.0.1 port 22"},"comment":{"url":"https://api.github.com/repos/netblue30/firejail/issues/comments/430009343","html_url":"https://github.com/netblue30/firejail/issues/2176#issuecomment-430009343","issue_url":"https://api.github.com/repos/netblue30/firejail/issues/2176","id":430009343,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMDAwOTM0Mw==","user":{"login":"publicsite","id":34146156,"node_id":"MDQ6VXNlcjM0MTQ2MTU2","avatar_url":"https://avatars0.githubusercontent.com/u/34146156?v=4","gravatar_id":"","url":"https://api.github.com/users/publicsite","html_url":"https://github.com/publicsite","followers_url":"https://api.github.com/users/publicsite/followers","following_url":"https://api.github.com/users/publicsite/following{/other_user}","gists_url":"https://api.github.com/users/publicsite/gists{/gist_id}","starred_url":"https://api.github.com/users/publicsite/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/publicsite/subscriptions","organizations_url":"https://api.github.com/users/publicsite/orgs","repos_url":"https://api.github.com/users/publicsite/repos","events_url":"https://api.github.com/users/publicsite/events{/privacy}","received_events_url":"https://api.github.com/users/publicsite/received_events","type":"User","site_admin":false},"created_at":"2018-10-15T20:53:54Z","updated_at":"2018-10-15T20:53:54Z","author_association":"NONE","body":"@smitsohu \r\n\r\nHi, I git cloned again with your changes, but unfortunately I get the same\r\n\r\n`Error: failed to run /run/firejail/lib/fseccomp`\r\n\r\nJust like to add; when firejail is used like so:\r\n\r\n`sudo firejail --noprofile chroot jails/rootfs /bin/sh`\r\n\r\nOr like so:\r\n\r\n`sudo /usr/local/bin/firejail --noprofile --chroot=jails/rootfs /bin/sh`\r\n\r\nBoth sshd and /bin/sh work, it's just the capabilities whitelist (--seccomp.keep) that doesn't work with the chroot option, which is almost certainly due to the /run/firejail/lib/fseccomp error.\r\n"}}
{"actor":{"display_login":"publicsite"}}