Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1127321 > unrolled thread

Bug#1025386: firejail: cannot use gdb with --allow-debuggers --profile=firefox

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1025386: firejail: cannot use gdb with --allow-debuggers --profile=firefox Vincent Lefevre <vincent@vinc17.net> - 2022-12-03 20:10 +0100
    Bug#1025386: firejail: cannot use gdb with --allow-debuggers --profile=firefox Reiner Herrmann <reiner@reiner-h.de> - 2022-12-10 19:00 +0100
      Bug#1025386: firejail: cannot use gdb with --allow-debuggers --profile=firefox Vincent Lefevre <vincent@vinc17.net> - 2022-12-22 19:30 +0100
        Bug#1025386: firejail: cannot use gdb with --allow-debuggers --profile=firefox Reiner Herrmann <reiner@reiner-h.de> - 2022-12-22 19:40 +0100
          Bug#1025386: firejail: cannot use gdb with --allow-debuggers --profile=firefox Vincent Lefevre <vincent@vinc17.net> - 2022-12-22 20:50 +0100
            Bug#1025386: firejail: cannot use gdb with --allow-debuggers --profile=firefox Reiner Herrmann <reiner@reiner-h.de> - 2022-12-22 21:00 +0100

#1127321 — Bug#1025386: firejail: cannot use gdb with --allow-debuggers --profile=firefox

Package: firejail
Version: 0.9.70-2
Severity: normal

I get the following error:

zira:~> firejail --allow-debuggers --profile=firefox gdb
Reading profile /etc/firejail/firefox.profile
Reading profile /home/vinc17/.config/firejail/firefox.local
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/firefox-common.profile
Reading profile /home/vinc17/.config/firejail/firefox-common.local
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-proc.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-run-common.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Warning: networking feature is disabled in Firejail configuration file
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Parent pid 1626894, child pid 1626897
Warning: cannot open source file /usr/lib/x86_64-linux-gnu/firejail/seccomp.debug32, file not copied
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: NVIDIA card detected, nogroups command ignored
Warning: NVIDIA card detected, nogroups command ignored
Warning: NVIDIA card detected, nogroups command ignored
Warning: NVIDIA card detected, nogroups command ignored
Warning: NVIDIA card detected, nogroups command ignored
Warning: NVIDIA card detected, nogroups command ignored
Warning: NVIDIA card detected, nogroups command ignored
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Warning: NVIDIA card detected, nogroups command ignored
Warning: NVIDIA card detected, nogroups command ignored
Child process initialized in 130.58 ms
Could not find platform independent libraries <prefix>
Could not find platform dependent libraries <exec_prefix>
Consider setting $PYTHONHOME to <prefix>[:<exec_prefix>]
Python path configuration:
  PYTHONHOME = (not set)
  PYTHONPATH = (not set)
  program name = '/usr/bin/python'
  isolated = 0
  environment = 1
  user site = 1
  import site = 1
  sys._base_executable = '/usr/bin/python'
  sys.base_prefix = '/usr'
  sys.base_exec_prefix = '/usr'
  sys.platlibdir = 'lib'
  sys.executable = '/usr/bin/python'
  sys.prefix = '/usr'
  sys.exec_prefix = '/usr'
  sys.path = [
    '/usr/lib/python310.zip',
    '/usr/lib/python3.10',
    '/usr/lib/lib-dynload',
  ]
Fatal Python error: init_fs_encoding: failed to get the Python codec of the filesystem encoding
Python runtime state: core initialized
ModuleNotFoundError: No module named 'encodings'

Current thread 0x00007f32e84a9640 (most recent call first):
  <no Python frame>

Parent is shutting down, bye...

-- System Information:
Debian Release: bookworm/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'stable-updates'), (500, 'stable-security'), (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental')
merged-usr: no
Architecture: amd64 (x86_64)

Kernel: Linux 6.0.0-5-amd64 (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=POSIX, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages firejail depends on:
ii  libapparmor1  3.0.7-1+b2
ii  libc6         2.36-6
ii  libselinux1   3.4-1+b3

Versions of packages firejail recommends:
ii  firejail-profiles  0.9.70-2
ii  iproute2           6.0.0-1+b1
ii  iptables           1.8.8-1
ii  xauth              1:1.1.1-1
ii  xdg-dbus-proxy     0.1.4-2
ii  xserver-xephyr     2:21.1.4-3
ii  xvfb               2:21.1.4-3

firejail suggests no packages.

-- no debconf information

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

[toc] | [next] | [standalone]

#1128409

Hi Vincent,

On Sat, Dec 03, 2022 at 07:59:43PM +0100, Vincent Lefevre wrote:
> zira:~> firejail --allow-debuggers --profile=firefox gdb
[...]
> Could not find platform independent libraries <prefix>
> Could not find platform dependent libraries <exec_prefix>
> Consider setting $PYTHONHOME to <prefix>[:<exec_prefix>]
> Python path configuration:
>   PYTHONHOME = (not set)
>   PYTHONPATH = (not set)
>   program name = '/usr/bin/python'
>   isolated = 0
>   environment = 1
>   user site = 1
>   import site = 1
>   sys._base_executable = '/usr/bin/python'
>   sys.base_prefix = '/usr'
>   sys.base_exec_prefix = '/usr'
>   sys.platlibdir = 'lib'
>   sys.executable = '/usr/bin/python'
>   sys.prefix = '/usr'
>   sys.exec_prefix = '/usr'
>   sys.path = [
>     '/usr/lib/python310.zip',
>     '/usr/lib/python3.10',
>     '/usr/lib/lib-dynload',
>   ]
> Fatal Python error: init_fs_encoding: failed to get the Python codec of the filesystem encoding
> Python runtime state: core initialized
> ModuleNotFoundError: No module named 'encodings'
> 
> Current thread 0x00007f32e84a9640 (most recent call first):
>   <no Python frame>

According to the firejail manpage, --allow-debuggers only takes care of
allowing system calls commonly used by debugging tools (e.g. ptrace).
It it not a parameter to broadly allow any debugger including their
dependency chains.
Debugging tools that have dependencies (like in your example gdb -> python3)
need to be handled additionally (either by asking gdb to not use the
python3 extensions, or by adding parameters that whitelist it).

With the following command line I was able to get a gdb shell:
> $ firejail --allow-debuggers --include=/etc/firejail/allow-python3.inc --profile=firefox gdb
> [...]
> (gdb)

Kind regards,
  Reiner

[toc] | [prev] | [next] | [standalone]

#1129894

Hi Reiner,

On 2022-12-10 18:48:39 +0100, Reiner Herrmann wrote:
> Debugging tools that have dependencies (like in your example gdb -> python3)
> need to be handled additionally (either by asking gdb to not use the
> python3 extensions, or by adding parameters that whitelist it).
> 
> With the following command line I was able to get a gdb shell:
> > $ firejail --allow-debuggers --include=/etc/firejail/allow-python3.inc --profile=firefox gdb
> > [...]
> > (gdb)

However, this is not a good solution from a security point of view.
There's a difference between allowing Python completely and just
embedding in some given application.

This could also be an issue in gdb. There should be a way to disable
Python, or have Python automatically disabled when not available.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

[toc] | [prev] | [next] | [standalone]

#1129895

On Thu, Dec 22, 2022 at 07:20:07PM +0100, Vincent Lefevre wrote:
> Hi Reiner,
> 
> On 2022-12-10 18:48:39 +0100, Reiner Herrmann wrote:
> > Debugging tools that have dependencies (like in your example gdb -> python3)
> > need to be handled additionally (either by asking gdb to not use the
> > python3 extensions, or by adding parameters that whitelist it).
> > 
> > With the following command line I was able to get a gdb shell:
> > > $ firejail --allow-debuggers --include=/etc/firejail/allow-python3.inc --profile=firefox gdb
> > > [...]
> > > (gdb)
> 
> However, this is not a good solution from a security point of view.
> There's a difference between allowing Python completely and just
> embedding in some given application.

This was just a suggestion to show that it is possible to run gdb.
If the permissions are too broad for you, you can create your own include
that is more narrow and only allows what is needed by gdb.

> This could also be an issue in gdb. There should be a way to disable
> Python, or have Python automatically disabled when not available.

You can install gdb-minimal. It does not have Python-support and works
with your original "firejail --allow-debuggers --profile=firefox gdb"
command line.

Kind regards,
  Reiner

[toc] | [prev] | [next] | [standalone]

#1129903

On 2022-12-22 19:27:37 +0100, Reiner Herrmann wrote:
> You can install gdb-minimal. It does not have Python-support and works
> with your original "firejail --allow-debuggers --profile=firefox gdb"
> command line.

But it is not co-installable with gdb. This is silly!

gdb-minimal apparently doesn't have source highlighting,
so I would need both. Or there should be a 3rd package
gdb-nopython.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

[toc] | [prev] | [next] | [standalone]

#1129905

On Thu, Dec 22, 2022 at 08:41:26PM +0100, Vincent Lefevre wrote:
> On 2022-12-22 19:27:37 +0100, Reiner Herrmann wrote:
> > You can install gdb-minimal. It does not have Python-support and works
> > with your original "firejail --allow-debuggers --profile=firefox gdb"
> > command line.
> 
> But it is not co-installable with gdb. This is silly!
> 
> gdb-minimal apparently doesn't have source highlighting,
> so I would need both. Or there should be a 3rd package
> gdb-nopython.

Please consider opening a bug against the gdb package then.
I think there is nothing I could change in firejail.

Regards,
  Reiner

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web