Shell not starting on login #6206
Comments
Longshot. There might be some confusion about correct syntax in login.users. Line 6 in 5d3b61d Yet, there's NO space between the user name and the program arguments: Line 10 in 5d3b61d Line 14 in 5d3b61d Have you tried dropping that space yet? So: $ cat /usr/local/etc/firejail/login.users | grep -v #
service:--profile=/usr/local/etc/firejail/service_user.profile |
|
Well spotted. I tried a few different login.users variants without that space; unfortunately that was not it, that made no difference. I did however notice that additional arguments change the error message in a peculiar way.
Error: no suitable HOME=/home/service executable found |
|
Ah well, the 'space' thing would have been too easy I guess :-) Other idea: the $ cat foo
service:--debug --profile=/usr/local/etc/firejail/noprofile.profile /bin/bash |
|
Well, at this point stabbing is fine by me =)
...both gets: Error: no suitable PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin executable found |
|
Found some time to come back to this. I can confirm that - at the very least - the Below are some observations, for a newly created user $ sudo grep guest /etc/password
guest:x:1002:1002:guest@lab16,,,,:/home/guest:/usr/bin/firejail
$ cat /etc/firejail/login.users
# /etc/firejail/login.users - restricted user shell configuration
#
# Each user entry consists of a user name and firejail
# program arguments:
#
# user name: arguments
#
# For example:
#
# netblue:--net=none --protocol=unix
#
# Wildcard patterns are accepted in the user name field:
#
# user*: --private
#
# The example will do --private for user1, user2, and so on.
#
# The extra arguments are inserted into program command line if firejail
# was started as a login shell.
## all restricted users:
#+ have throwaway data [--private]
#+ are provided a very restricted shell [--private-bin=bash,ls,sh]
#+ have tab-completion [--tab]
*:--quiet --private --private-bin=bash,ls,sh --tab
What isn't working: $ su -l guest
Password:
Cannot start application: No such file or directory$ su guest
Password:
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/globals.local
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-common.local
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-programs.local
Reading profile /etc/firejail/landlock-common.inc
Reading profile /etc/firejail/landlock-common.local
** Note: you can use --noprofile to disable default.profile **
firejail version 0.9.73
Parent pid 51288, child pid 51290
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Base filesystem installed in 84.97 ms
Child process initialized in 150.05 ms
Cannot start application: Permission denied
Parent is shutting down, bye...$ su -l guest /bin/bash
Password:
Error: no suitable HOME=/home/guest executable foundWhat seems to work: $ su guest /bin/bash
Password:
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/globals.local
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-common.local
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-programs.local
Reading profile /etc/firejail/landlock-common.inc
Reading profile /etc/firejail/landlock-common.local
** Note: you can use --noprofile to disable default.profile **
firejail version 0.9.73
Parent pid 54796, child pid 54798
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Base filesystem installed in 90.97 ms
Child process initialized in 159.25 ms
[guest@lab16 ~]$ cat .bashrc
#
# ~/.bashrc
#
# If not running interactively, don't do anything
[[ $- != *i* ]] && return
alias ls='ls --color=auto'
alias grep='grep --color=auto'
PS1='[\u@\h \W]\$ '
[guest@lab16 ~]$ echo "I should be discarded after closing the sandbox due to --private" > discard.me
[guest@lab16 ~]$ exit
exit
Parent is shutting down, bye...
glitsj16@lab16 $ sudo cat /home/guest/discard.me
I should be discarded after closing the sandbox due to --private
I used
Side-note: Marking this as a bug. |
|
A workaround seems to be putting the firejail command in a login shell script, like: # cat login.sh
# chsh -s /path/login.sh service |
|
Thanks for the workaround. Can your user |
|
This is an embedded system, so at this point I have only been able to test su -l and ssh. Nothing special was needed in the profile for that. Will get back to you if I get a chance to test tty. |
|
No problem. Nice to see firejail being used on embedded systems. Thanks again for reporting this. Now we're aware of the issue we can work towards a fix that actually respects what is in login.users. Cheers |
Description
Trying to use firejail to execute a login shell (for user "service").
Grateful for input on this.
Steps to Reproduce
Firejail is set as shell.
And a shell profile that is included from login.users exists:
If no shell is provided no command is found:
Fair enough, so provide a shell:
Expected behavior
Bash as login shell
Actual behavior
Firejail is unable to find a working shell path
Behavior without a profile
Environment
/usr/local/bin/firejail --version
firejail version 0.9.73
uname -a
Linux ubuntu 5.15.0-91-generic #101~20.04.1-Ubuntu SMP Thu Nov 16 14:22:28 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
git rev-parse HEAD
bb45aa5
Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)Log
The text was updated successfully, but these errors were encountered: