--build clears the environment

[rusty-snake]

Bug and expected behavior

• Describe the bug.

--build clears the env. Only a few firejail set variables and LANG, PATH, DISPLAY and SHELL are kept.

$ firejail --build printenv
LANG=de_DE.UTF-8
PATH=/home/rusty-snake/.config/firecfg.py/overrides/bin:/etc/firecfg.py/overrides/bin:/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/home/rusty-snake/.local/bin:/home/rusty-snake/.cargo/bin
DISPLAY=:0
QT_X11_NO_MITSHM=1
QML_DISABLE_DISK_CACHE=1
container=firejail
SHELL=/bin/bash
KDE_FORK_SLAVES=1
PROMPT_COMMAND=:
FIREJAIL_QUIET=yes

This makes --build unusable for programs which assume variables like HOME are set (os.environ["HOME"]).

• What did you expect to happen?

Variables like HOME are still present.

Reproduce
Steps to reproduce the behavior:

1. Run in bash firejail --build printenv
2. See error nearly empty environment

Environment

• Linux distribution and version: Fedora 34
• Firejail version: 0.9.66+3836131f-dirty

Checklist

• The profile (and redirect profile if exists) hasn't already been fixed upstream.
• The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
• I have performed a short search for similar issues (to avoid opening a duplicate).
• If it is a AppImage, --profile=PROFILENAME is used to set the right profile.
• Used LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM to get english error-messages.
• I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
• This is not a question. Questions should be asked in https://github.com/netblue30/firejail/discussions.

[jmetrius]

firejail applies a filtered set of environment variables before handing off to fbuilder which takes care of the actual profile building. fbuilder itself does nothing to restore the original environment before starting the sandbox via firejail

firejail/src/firejail/main.c

Lines 925 to 947 in 04fba33

	static void run_builder(int argc, char **argv) {
	EUID_ASSERT();
	(void) argc;
	// drop privileges
	if (setresgid(-1, getgid(), getgid()) != 0)
	errExit("setresgid");
	if (setresuid(-1, getuid(), getuid()) != 0)
	errExit("setresuid");
	assert(env_get("LD_PRELOAD") == NULL);
	assert(getenv("LD_PRELOAD") == NULL);
	umask(orig_umask);
	// restore some environment variables
	env_apply_whitelist_sbox();
	argv[0] = LIBDIR "/firejail/fbuilder";
	execvp(argv[0], argv);
	perror("execvp");
	exit(1);
	}

Using env_apply_all() at line 940 gives the expected behaviour for firejail --build printenv.

However I don't understand what the intention for handing over a sanitized environment for fbuilder actually is. If restoring the original environment from fbuilder should be more desirable, the solution doesn't seem that trivial.

[rusty-snake]

Maybe it is just a code-path forgotten in #3322. @topimiettinen?

[topimiettinen]

I haven't used --build, but if fbuilder needs all environment variables, the fix should be simply to change env_apply_whitelist_sbox() to env_apply_all().