RTNETLINK error using "--net" option

[fvdb06]

As soon I start firejail with the --net option I get unexpectedly exited with status 1

RTNETLINK answers: Operation not supported

---

muser@Cantara > firejail --net=tornet --noprofile
Parent pid 7935, child pid 7940
RTNETLINK answers: Operation not supported
Error: failed to run /usr/lib/firejail/fnet
Error ioctl: interface.c:98 net_if_up: No such device
Error: failed to run /run/firejail/lib/fnet
Error: proc 7935 cannot sync with peer: unexpected EOF
Peer 7940 unexpectedly exited with status 1

---

muser@Cantara > firejail --net=eth0 --noprofile
Parent pid 4489, child pid 4494
RTNETLINK answers: Operation not supported
Error: failed to run /usr/lib/firejail/fnet
Error ioctl: interface.c:98 net_if_up: No such device
Error: failed to run /run/firejail/lib/fnet
Error: proc 4489 cannot sync with peer: unexpected EOF
Peer 4494 unexpectedly exited with status 1

[smitsohu]

Looks like a duplicate of #2046.
Which Firejail version do you run?

[fvdb06]

#2046 states: my error was fixed at some point.
Unfortunately this is not my case.
muser@Cantara > pacman -Q firejail
firejail 0.9.58-1

[netblue30]

Run a /sbin/ifconfig and put the output here. How are your interfaces configured?

[fvdb06]

muser@Cantara > /sbin/ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.178.64  netmask 255.255.255.0  broadcast 192.168.178.255
        ether 74:d0:2b:7b:da:d6  txqueuelen 1000  (Ethernet)
        RX packets 12262  bytes 14616580 (13.9 MiB)
        RX errors 0  dropped 217  overruns 0  frame 0
        TX packets 7830  bytes 1508827 (1.4 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 20  memory 0xf7d00000-f7d20000  

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 3454  bytes 3909249 (3.7 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 3454  bytes 3909249 (3.7 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tornet: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.100.100.1  netmask 255.255.255.0  broadcast 10.100.100.255
        ether 42:ba:ba:aa:84:81  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 83  bytes 8968 (8.7 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

----------------------------------------------------------------
## /etc/systemd/network/25-wireless.network

[Match]
Name=wlan0

[Network]
## DHCP=yes to accept an IPv4 and IPv6 DHCP ##
#DHCP=ipv4
DHCP=yes
IPv6PrivacyExtensions=true
## to use static IP uncomment these instead of DHCP
#Address=192.168.1.87/24
#Gateway=192.168.1.255

## enable "LLMNR" for "systemd-resolved" so you can ping a "hostname"	##
## in local network directly without a formal dns server setup.		##
LLMNR=true

[DHCP]
RouteMetric=20

-------------------------------------------------------------
## /etc/systemd/network/50-wired.network

[Match]
#Name=eth0
Name=e*

[Network]
## DHCP=yes to accept an IPv4 and IPv6 DHCP ##
#DHCP=ipv4
DHCP=yes
IPv6PrivacyExtensions=true
## to use static IP uncomment these instead of DHCP
#Address=192.168.1.87/24
#Gateway=192.168.1.255

## enable "LLMNR" for "systemd-resolved" so you can ping a "hostname"	##
## in local network directly without a formal dns server setup.		##
LLMNR=true

[DHCP]
RouteMetric=10

[glitsj16]

@fvdb06 This is a longshot, but have you already checked the restricted-network setting in your /etc/firejail/firejail.config? If you happen to see 'restricted-network yes' that would explain things, as in that case access to --interface, --net=foo and --netfilter is only granted to root user.

[netblue30]

Thanks @glitsj16, that could be the problem!

[fvdb06]

For me this is not the problem: /etc/firejail/firejail.config

#Enable or disable restricted network support, default disabled. If enabled,
#networking features should also be enabled (network yes).
#Restricted networking grants access to --interface, --net=ethXXX and
#--netfilter only to root user. Regular users are only allowed --net=none.
restricted-network no

[fvdb06]

I recently changed the start-up of my windowmanager. I start Fluxbox with systemd instead of .xinitrc
Has it a relationship with this????

[intika]

Had a similar issue, this can be caused by a kernel update without reboot or a lack of needed kernel modules, to fix it either use a classic (main distribution) kernel or add the missing modules to your kernel

Also this Error ioctl: interface.c:98 net_if_up: No such device is typically raising because of missing module CONFIG_IPVLAN and or CONFIG_IPV6 technically --net parameter require only ipvlan but ipvlan have a "false" dependency on ipv6 there is kernel patch to fix that here or here if you still want to keep ipv6 disabled while getting firejail network feature working otherwise just add ipv6 along with ipvlan

Alternatively ifup lo command can give more details on error/missing module that could affect "firejail --net"

Here are the required kernel modules for firejail networking features: (this is an exhaustive list to get everything working you should be good with just ipvlan)

CONFIG_IPVLAN=m
CONFIG_IPVTAP=m
CONFIG_VXLAN=m
CONFIG_NET_VRF=m
CONFIG_NF_TABLES=m
CONFIG_NF_TABLES_NETDEV=m
CONFIG_NFT_RT=m
CONFIG_NFT_MASQ=m
CONFIG_NFT_REDIR=m
CONFIG_NFT_NAT=m
CONFIG_NFT_REJECT=m
CONFIG_NF_TABLES_IPV4=m
CONFIG_NFT_REJECT_IPV4=m
CONFIG_NFT_MASQ_IPV4=m
CONFIG_NFT_REDIR_IPV4=m
CONFIG_BRIDGE_EBT_VLAN=m
CONFIG_GARP=m
CONFIG_MRP=m
CONFIG_BRIDGE_VLAN_FILTERING=y
CONFIG_VLAN_8021Q=m
CONFIG_VLAN_8021Q_GVRP=y
CONFIG_VLAN_8021Q_MVRP=y
CONFIG_NET_L3_MASTER_DEV=y

Note that this also fix RTNETLINK answers: Operation not supported @netblue30 this info could may be added to the wiki or faq

[rusty-snake]

Duplicate of #2046