Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1129895

Bug#1025386: firejail: cannot use gdb with --allow-debuggers --profile=firefox

Show all headers | View raw

On Thu, Dec 22, 2022 at 07:20:07PM +0100, Vincent Lefevre wrote:
> Hi Reiner,
> 
> On 2022-12-10 18:48:39 +0100, Reiner Herrmann wrote:
> > Debugging tools that have dependencies (like in your example gdb -> python3)
> > need to be handled additionally (either by asking gdb to not use the
> > python3 extensions, or by adding parameters that whitelist it).
> > 
> > With the following command line I was able to get a gdb shell:
> > > $ firejail --allow-debuggers --include=/etc/firejail/allow-python3.inc --profile=firefox gdb
> > > [...]
> > > (gdb)
> 
> However, this is not a good solution from a security point of view.
> There's a difference between allowing Python completely and just
> embedding in some given application.

This was just a suggestion to show that it is possible to run gdb.
If the permissions are too broad for you, you can create your own include
that is more narrow and only allows what is needed by gdb.

> This could also be an issue in gdb. There should be a way to disable
> Python, or have Python automatically disabled when not available.

You can install gdb-minimal. It does not have Python-support and works
with your original "firejail --allow-debuggers --profile=firefox gdb"
command line.

Kind regards,
  Reiner

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1025386: firejail: cannot use gdb with --allow-debuggers --profile=firefox Vincent Lefevre <vincent@vinc17.net> - 2022-12-03 20:10 +0100
  Bug#1025386: firejail: cannot use gdb with --allow-debuggers --profile=firefox Reiner Herrmann <reiner@reiner-h.de> - 2022-12-10 19:00 +0100
    Bug#1025386: firejail: cannot use gdb with --allow-debuggers --profile=firefox Vincent Lefevre <vincent@vinc17.net> - 2022-12-22 19:30 +0100
      Bug#1025386: firejail: cannot use gdb with --allow-debuggers --profile=firefox Reiner Herrmann <reiner@reiner-h.de> - 2022-12-22 19:40 +0100
        Bug#1025386: firejail: cannot use gdb with --allow-debuggers --profile=firefox Vincent Lefevre <vincent@vinc17.net> - 2022-12-22 20:50 +0100
          Bug#1025386: firejail: cannot use gdb with --allow-debuggers --profile=firefox Reiner Herrmann <reiner@reiner-h.de> - 2022-12-22 21:00 +0100

csiph-web