Security Adivsory - Feb 8, 2021

Summary: A vulnerability resulting in root privilege escalation was discovered in
Firejail's OverlayFS code,

Versions affected: Firejail software versions starting with 0.9.30.
Long Term Support (LTS) Firejail branch is not affected by this bug.

Workaround: Disable overlayfs feature at runtime.
In a text editor open /etc/firejail/firejail.config file, and set "overlayfs" entry to "no".

      $ grep overlayfs /etc/firejail/firejail.config
      # Enable or disable overlayfs features, default enabled.
      overlayfs no

Fix: The bug is fixed in Firejail version 0.9.64.4

GitHub commit: (file configure.ac)
https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b

Credit:  Security researcher Roman Fiedler analyzed the code and discovered the vulnerability.
Functional PoC exploit code was provided to Firejail development team.
A description of the problem is here on Roman's blog:

https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt
https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/

$ git clone https://github.com/netblue30/firejail.git
$ cd firejail
$ ./configure && make && sudo make install-strip

$ sudo apt-get install git build-essential libapparmor-dev pkg-config gawk

$ firejail firefox            # starting Mozilla Firefox
$ firejail transmission-gtk   # starting Transmission BitTorrent
$ firejail vlc                # starting VideoLAN Client
$ sudo firejail /etc/init.d/nginx start

$ firejail --list
1617:netblue:/usr/bin/firejail /usr/bin/firefox-esr
7719:netblue:/usr/bin/firejail /usr/bin/transmission-qt
7779:netblue:/usr/bin/firejail /usr/bin/galculator
7874:netblue:/usr/bin/firejail /usr/bin/vlc --started-from-file file:https:///home/netblue/firejail-whitelist.mp4
7916:netblue:firejail --list

$ firecfg --fix-sound
$ sudo firecfg

JAILTEST(1)                    JAILTEST man page                   JAILTEST(1)

NAME
       jailtest - Simple utility program to test running sandboxes

SYNOPSIS
       sudo jailtest [OPTIONS] [directory]

DESCRIPTION
       WORK IN PROGRESS!  jailtest attaches itself to all sandboxes started by
       the user and performs some basic tests on the sandbox filesystem:

       1. Virtual directories
              jailtest extracts a list with the main virtual  directories  in‐
              stalled by the sandbox.  These directories are build by firejail
              at startup using --private* and --whitelist commands.

       2. Noexec test
              jailtest inserts executable programs  in  /home/username,  /tmp,
              and  /var/tmp  directories and tries to run them form inside the
              sandbox, thus testing if the directory is executable or not.

       3. Read access test
              jailtest creates test files in the directories specified by  the
              user and tries to read them from inside the sandbox.

       4. AppArmor test

       5. Seccomp test

       The program is started as root using sudo.

OPTIONS
       --debug
              Print debug messages

       -?, --help
              Print options end exit.

       --version
              Print program version and exit.

       [directory]
              One  or  more  directories in user home to test for read access.
              ~/.ssh and ~/.gnupg are tested by default.

OUTPUT
       For each sandbox detected we print the following line:

            PID:USER:Sandbox Name:Command

       It is followed by relevant sandbox information, such as the virtual di‐
       rectories and various warnings.

EXAMPLE
       $ sudo jailtest
       2014:netblue::firejail /usr/bin/gimp
          Virtual dirs: /tmp, /var/tmp, /dev, /usr/share,
          Warning: I can run programs in /home/netblue

       2055:netblue::firejail /usr/bin/ssh -X [email protected]
          Virtual dirs: /var/tmp, /dev, /usr/share, /run/user/1000,
          Warning: I can read ~/.ssh

       2186:netblue:libreoffice:firejail --appimage /opt/LibreOffice-fresh.ap‐
       pimage
          Virtual dirs: /tmp, /var/tmp, /dev,

       26090:netblue::/usr/bin/firejail /opt/firefox/firefox
          Virtual dirs: /home/netblue, /tmp, /var/tmp, /dev, /etc, /usr/share,
                        /run/user/1000,

       26160:netblue:tor:firejail --private=~/tor-browser_en-US ./start-tor
          Warning: AppArmor not enabled
          Virtual dirs: /home/netblue, /tmp, /var/tmp, /dev, /etc, /bin,
                        /usr/share, /run/user/1000,
          Warning: I can run programs in /home/netblue

LICENSE
       This program is free software; you can redistribute it and/or modify it
       under  the  terms of the GNU General Public License as published by the
       Free Software Foundation; either version 2 of the License, or (at  your
       option) any later version.

       Homepage: https://firejail.wordpress.com

SEE ALSO
       firejail(1),  firemon(1), firecfg(1), firejail-profile(5), firejail-lo‐
       gin(5), firejail-users(5),

0.9.65                             Feb 2021                        JAILTEST(1)

$ sudo cp src/profstats/profstats /etc/firejail/.
$ cd /etc/firejail
$ ./profstats *.profile
Warning: multiple caps in transmission-daemon.profile

Stats:
    profiles			1077
    include local profile	1077   (include profile-name.local)
    include globals		1077   (include globals.local)
    blacklist ~/.ssh		971   (include disable-common.inc)
    seccomp			988
    capabilities		1076
    noexec			960   (include disable-exec.inc)
    memory-deny-write-execute	231
    apparmor			621
    private-bin			571
    private-dev			949
    private-etc			470
    private-tmp			835
    whitelist home directory	508
    whitelist var		758   (include whitelist-var-common.inc)
    whitelist run/user		539   (include whitelist-runuser-common.inc
					or blacklist ${RUNUSER})
    whitelist usr/share		526   (include whitelist-usr-share-common.inc
    net none			354
    dbus-user none 		573
    dbus-user filter 		86
    dbus-system none 		706
    dbus-system filter 		7