Profile requests #825

netblue30 · 2016-10-01T16:41:38Z

Leave them on this thread, I'll bring them on top and strike them through when implemented.

Natron, Cinelerra, ~~Inkscape~~, ~~Gimp~~, ~~LuminanceHDR~~, ~~QpdfView~~, ~~Synfigstudio~~, Otter browser, Calligra, ~~Openshot~~, Scribus, Temaviewer, Blender, Google Earth, darktable, shotcut, Ricochet (https://ricochet.im/), Tbb (http:https://www.webupd8.org/2013/12/tor-browser-bundle-ubuntu-ppa.html), ~~Wire (https://medium.com/wire-news/get-your-linux-on-999403a1a4fe#.fb99nx4uq)~~, ~~flowblade~~, ~~VirtualBox~~, jmemorize, amarok, dragon (Dragon Player), kate, KTnef, KTorrent, Akregator, KRDC, discover, k3b, dolphin, ark, KWalletManager, skanlite, xpra, bleachbit, gedit, nautilus, xfburn, file-roller, gnome-books, gnome-photos, gnome-online-miners, gnome-sound-recorder, gnome-contacts, gnome-documents, gnome-weather, gnome-music, gnome-maps, brasero, goobox, gpa, simple-scan

Laurent092 · 2016-10-02T06:05:20Z

Hi netblue,
Teamviewer is used sometimes to help some people but I heard that there was some attack on it. Do you think it's possible to add a secure profile for this software ?
Thanks
Laurent.

Uploading TeamViewer_noprofile_debug.txt…

netblue30 · 2016-10-02T12:37:05Z

Sure, give me a link to the project website.

chiraag-nataraj · 2016-10-02T15:40:34Z

https://www.teamviewer.com/en/download/linux/
But there's a problem. I'm not exactly sure how Teamviewer verifies the daemon is running (probably looking for a process?), but when I launch Teamviewer within firejail (even with --noprofile), it fails to detect that the daemon is already running (hence my suspicion that it is looking for a process - the new PID namespace would preclude it from detecting the daemon).

[Edit] Yup, my suspicion was correct. The relevant code is in /opt/teamviewer/tv_bin/script/tvw_exec under the function IsDaemonRunning. It basically uses ps and grep to look for a process called teamviewerd. @netblue30, is there any way to selectively "pass through" processes from the global PID namespace into the local PID namespace? This would be the preferred way to fix this as teamviewerd is started as a system service.

Laurent092 · 2016-10-02T18:56:58Z

It could be great if you find a solution. I am currently installing a Linux OS on a laptop for a friend and he asked me if I could install teamviewer. I said yes if I can sandbox it !! And I think a lot of people will be aware of that because they generally deinstalled it after doing the maintenance because of security issue. Firejail could be the best solution for me and my future installation on some laptop ;)

netblue30 · 2016-10-03T14:15:32Z

@Laurent092, the default profile will work fine until we come up with a more restrictive one. The main security features such as seccomp and noroot are implemented in the default profile. Start the program as "firejail teamviewer" - I assume teamviewer is the name of the program.

nyancat18 · 2016-10-03T15:16:21Z

Could you add these profiles too?
1 Blender

2 Google earth, marble dont have some google earth's features, and this is propietary software

chiraag-nataraj · 2016-10-03T18:59:02Z

@netblue30 The default profile does not work because of the reasons I specified. In fact, even using --noprofile does not work because firejail creates a PID namespace, leading Teamviewer to think the daemon has not been started. It then can't start the daemon because it doesn't have root privileges (it uses upstart/systemd/sysv/etc to start the daemon).

Laurent092 · 2016-10-03T19:08:17Z

Hi netblue. i agree with chiraag. It doesn't work. The TeamViewer GUI launched a pop-up message that indicates the daemon is not running :

firejail teamviewer
Reading profile /etc/firejail/generic.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc

** Note: you can use --noprofile to disable generic.profile **

Parent pid 2173, child pid 2174

Child process initialized

Init...
XRandRWait: No value set. Using default.
XRandRWait: Started by user.
Checking setup...
Launching TeamViewer ...
Starting network process (no daemon)
terminate called without an active exception
/opt/teamviewer/tv_bin/script/tvw_exec : ligne 95 : 113 Abandon "$TV_BIN_DIR/teamviewerd" -n -f
Network process already started (or error)
Launching TeamViewer GUI ...

parent is shutting down, bye...

netblue30 · 2016-10-03T20:45:53Z

Sorry, didn't see the description.

It cannot be sandboxed the normal way - the guy needs to become root and start daemons. That's bad, you are running a closed source executable as root!

chiraag-nataraj · 2016-10-03T20:53:03Z

Do we have a way to poke holes in the PID namespace so that teamviewer recognizes that its daemon is running?

chiraag-nataraj · 2016-10-04T03:54:34Z

@triceratops1 Blender is up on my repo. Give it a whirl!

chiraag-nataraj · 2016-10-04T18:25:51Z

@netblue30, @triceratops1 I'm running into an interesting issue with Google Earth. If I run it within firejail, even with --noprofile, Google Earth fails to remove its lock file. That is, if I start it up again, it complains that it's already running. I'm going to look into workarounds for this issue, but your perspectives on it would be appreciated.

[Edit] Ah, okay, I think this makes more sense. When Google Earth runs, it creates a symlink to /proc/<PID>. I guess it's not able to remove the symlink afterwards for some reason - is this something that firejail prohibits?

Laurent092 · 2016-10-04T20:24:53Z

@chiraag-nataraj about googleearth,
I apply a workaround in using firejail --private googleearth. The lock file is always remove at the end of the session.

chiraag-nataraj · 2016-10-04T20:30:49Z

@Laurent092 Yeah, that works. However, that means the config files aren't saved, which is theoretically annoying?

[Edit] For the record, this is actually false. It saves "My Places" and miscellaneous temporary information to that folder. Config actually goes in ~/.config/Google/. Still, you normally want to save places, so I had to work around this another way.

Laurent092 · 2016-10-04T20:38:18Z

i saw in the man of firejail you have many choice for --private (bin, etc....)
Where is located the lock file ?

chiraag-nataraj · 2016-10-04T20:57:25Z

The lock file is located in ~/.googleearth, which is also the directory configuration files are stored in.

Laurent092 · 2016-10-04T21:38:00Z

firejail --blacklist=dirname_or_filename
Blacklist directory or file.

          Example:
          $ firejail --blacklist=/sbin --blacklist=/usr/sbin
          $ firejail --blacklist=~/.mozilla
          $ firejail "--blacklist=/home/username/My Virtual Machines"

chiraag-nataraj · 2016-10-04T22:03:38Z

Never mind, found a way around it 😃 I'll have a profile up soon

chiraag-nataraj · 2016-10-04T22:12:28Z

Google Earth is up on my repo!

nyancat18 · 2016-10-07T15:59:01Z

We could add some extra profiles
1 google chrome (its required if you need flash), but flash is VERY VULNERABLE, and you need sanbox it

2 flowblade

chiraag-nataraj · 2016-10-08T01:36:31Z

Huh, so interesting thing about flowblade. If I run it within firejail, even with --noprofile, it gets hung on the code after printing "Exiting app...". Even after adding additional statements to try to track down the problem, it seems to completely finish even calling Gtk.main_quit(), so I'm not even sure what the problem is...
[Edit] I should note that this problem does not occur if I don't change anything and immediately exit.
[Edit2] Never mind. I found out it was rendering the audio of the file I imported.

chiraag-nataraj · 2016-10-08T03:22:26Z

Added Flowblade to my repo! As for Google Chrome, I believe a profile already exists. And if you specifically want a stricter profile than the default, please open the issue on my project page rather than here, since it's easy to get confused 😃
[Edit] Added Google Chrome to my repo anyway 😉

qazip · 2016-10-11T18:20:45Z

Wire has now a Linux client (https://medium.com/wire-news/get-your-linux-on-999403a1a4fe#.fb99nx4uq)

Would be nice to have a default profile for it.

denizakcal · 2016-10-14T23:22:55Z

Hello, netblue30. :)

Could you please add a profile for VirtualBox to the default Firejail installation (when you get the chance)?

chiraag-nataraj · 2016-10-15T00:22:22Z

@denizakcal, check out my repo in the meantime :) I happen to have a profile for Virtualbox.

netblue30 · 2016-10-18T18:24:20Z

VirtualBox, flowblade and OpenShot done.

denizakcal · 2016-10-20T04:51:36Z

@chiraag-nataraj: Sorry for the delay. Your temporary solution no longer seems necessary, but I appreciate it nonetheless, so thanks! :)

@netblue30: Thanks for the VirtualBox profile (included in the default Firejail installation)!

If it's not too much to ask, could you also make a profile (included in the default Firejail installation) for jMemorize ( https://sourceforge.net/projects/jmemorize/ ) (especially since it doesn't seem maintained anymore, which, I'm not a security expert, but I believe it makes it more of a security risk)?

netblue30 · 2016-10-20T12:45:25Z

I added jmemorize to the list.

denizakcal · 2016-10-20T23:23:34Z

Thanks. :)

kesso · 2016-11-17T02:37:03Z

It would be nice to have profiles for the default kde and gnome applications and some others:

amarok, dragon (Dragon Player), kate, KTnef, KTorrent, Akregator, KRDC, discover, k3b, dolphin, ark, KWalletManager, skanlite, xpra, bleachbit, gedit, nautilus, xfburn, file-roller, gnome-books, gnome-photos, gnome-online-miners, gnome-sound-recorder, gnome-contacts, gnome-documents, gnome-weather, gnome-music, gnome-maps, brasero, goobox, gpa, simple-scan

curiosity-seeker · 2016-11-23T16:30:36Z

The recently published vulnerabilities in Linux

https://scarybeastsecurity.blogspot.de/2016/11/0day-poc-risky-design-decisions-in.html
https://scarybeastsecurity.blogspot.de/2016/11/0day-exploit-advancing-exploitation.html

make me wonder if it's possible to sandbox the various indexing tools (Tracker in Gnome, Baloo in KDE, ...) with Firejail as suggested by Chris Evans.

valoq · 2016-11-28T15:17:16Z

There is already a profile for tracker, however the problem is that these are services that are started by systemd or via dbus by other applications and therefore firejail is not automatically applied.

It might be possible to have firejail sandbox those services but this needs a closer look.

slicer69 · 2016-12-16T14:25:19Z

I don't think anyone has mentioned the Qupzilla web browser yet. I put together a rough profile for Qupzilla in case anyone wants to expand on it. It is basically the Firefox profile with the config and cache paths changed and some unneeded permissions removed.

qupzilla.txt

netblue30 · 2016-12-16T18:01:57Z

I merged QupZilla profile, thanks!

qazip · 2016-12-28T10:29:41Z

Profile requests:

Ghetto-skype (https://github.com/stanfieldr/ghetto-skype);
Riot (https://riot.im/); Riot has now a linux client.

added uzbl-browser.profile (refs #825)

qazip · 2017-01-24T20:59:59Z

Profile requests:

Iridium Browser (https://iridiumbrowser.de/)

netblue30 · 2017-01-25T14:04:30Z

I'll try it out.

nyancat18 · 2017-01-26T02:13:51Z

@netblue30 and waterfox (a good firefox fork) :D

CreamyCookie · 2017-02-26T21:57:16Z

Could you add rambox (open source alternative to Franz multi messenger)?

https://github.com/saenzramiro/rambox

0xBRM · 2017-02-26T23:12:48Z

Discord.

netblue30 · 2017-03-10T12:54:06Z

Moved to #1139

pemartins1 · 2017-06-26T19:44:54Z

I'd like to request a profile for Geary Email Client (https://github.com/GNOME/geary).

Thank you very much and keep up with the good work.

This was referenced Oct 1, 2016

Enhacement: some profiles #823

Closed

[Request] New profiles #812

Closed

New profiles #732

Closed

This was referenced Oct 9, 2016

New profiles #847

Closed

Suggest: Extra profiles #848

Closed

netblue30 added the enhancement New feature request label Oct 9, 2016

Fred-Barclay mentioned this issue Oct 25, 2016

Extra profiles #872

Merged

valoq mentioned this issue Oct 29, 2016

Added profiles for display (imagemagick) and wire #881

Merged

GSI pushed a commit to GSI/firejail that referenced this issue Jan 20, 2017

added uzbl-browser.profile (refs netblue30#825)

9ab87bc

netblue30 pushed a commit that referenced this issue Jan 20, 2017

Merge pull request #1060 from GSI/uzbl-browser

30ec01f

added uzbl-browser.profile (refs #825)

valoq mentioned this issue Feb 12, 2017

added iridium browser profile #1099

Merged

netblue30 closed this as completed Mar 10, 2017

chiraag-nataraj mentioned this issue Dec 18, 2017

TeamViewer profile chiraag-nataraj/firejail-profiles#21

Closed

netblue30 mentioned this issue Feb 2, 2020

Profile requests #1139

Open

Profile requests #825

Profile requests #825

Comments

netblue30 commented Oct 1, 2016 • edited

Laurent092 commented Oct 2, 2016 • edited

netblue30 commented Oct 2, 2016

chiraag-nataraj commented Oct 2, 2016 • edited

Laurent092 commented Oct 2, 2016

netblue30 commented Oct 3, 2016

nyancat18 commented Oct 3, 2016

chiraag-nataraj commented Oct 3, 2016

Laurent092 commented Oct 3, 2016 • edited

netblue30 commented Oct 3, 2016

chiraag-nataraj commented Oct 3, 2016

chiraag-nataraj commented Oct 4, 2016

chiraag-nataraj commented Oct 4, 2016 • edited

Laurent092 commented Oct 4, 2016

chiraag-nataraj commented Oct 4, 2016 • edited

Laurent092 commented Oct 4, 2016

chiraag-nataraj commented Oct 4, 2016 • edited

Laurent092 commented Oct 4, 2016

chiraag-nataraj commented Oct 4, 2016

chiraag-nataraj commented Oct 4, 2016

nyancat18 commented Oct 7, 2016

chiraag-nataraj commented Oct 8, 2016 • edited

chiraag-nataraj commented Oct 8, 2016 • edited

qazip commented Oct 11, 2016

denizakcal commented Oct 14, 2016

chiraag-nataraj commented Oct 15, 2016

netblue30 commented Oct 18, 2016

denizakcal commented Oct 20, 2016

netblue30 commented Oct 20, 2016

denizakcal commented Oct 20, 2016

kesso commented Nov 17, 2016 • edited

curiosity-seeker commented Nov 23, 2016 • edited

valoq commented Nov 28, 2016

slicer69 commented Dec 16, 2016

netblue30 commented Dec 16, 2016

qazip commented Dec 28, 2016

qazip commented Jan 24, 2017

netblue30 commented Jan 25, 2017

nyancat18 commented Jan 26, 2017

CreamyCookie commented Feb 26, 2017 • edited

0xBRM commented Feb 26, 2017

netblue30 commented Mar 10, 2017

pemartins1 commented Jun 26, 2017

netblue30 commented Oct 1, 2016 •

edited

Laurent092 commented Oct 2, 2016 •

edited

chiraag-nataraj commented Oct 2, 2016 •

edited

Laurent092 commented Oct 3, 2016 •

edited

chiraag-nataraj commented Oct 4, 2016 •

edited

chiraag-nataraj commented Oct 4, 2016 •

edited

chiraag-nataraj commented Oct 4, 2016 •

edited

chiraag-nataraj commented Oct 8, 2016 •

edited

chiraag-nataraj commented Oct 8, 2016 •

edited

kesso commented Nov 17, 2016 •

edited

curiosity-seeker commented Nov 23, 2016 •

edited

CreamyCookie commented Feb 26, 2017 •

edited