search

haad / proxychains

proxychains - a tool that forces any TCP connection made by any given application to follow through proxy like TOR or any other SOCKS4, SOCKS5 or HTTP(S) proxy. Supported auth-types: "user/pass" for SOCKS4/5, "basic" for HTTP.
http://proxychains.sourceforge.net/
GNU General Public License v2.0
6.27k stars 603 forks source link

firejail defeats proxychains #124

Open tredondo opened 2 years ago

tredondo commented 2 years ago

I have proxychains configured with socks5 10.8.0.1 1080.

This works as expected - wget goes through the proxy:

$ proxychains wget -q github.com
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.14
[proxychains] Strict chain  ...  10.8.0.1:1080  ...  github.com:443  ...  OK

But by putting firejail in front of wget, it fetches the file, and proxychains doesn't log anything!

$ proxychains firejail wget -q github.com
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4

Is that expected? I do see a warning in the README but I can't tell how this applies to firejail.

this program works only on dynamically linked programs. also both proxychains and the program to call must use the same dynamic linker (i.e. same libc)

rusty-snake commented 2 years ago

Is that expected?

Yes because you can not LD_PRELOAD libraries into SUIDs for security reasons (https://github.com/netblue30/firejail/discussions/4156).