search

netblue30 / firejail

Linux namespaces and seccomp-bpf sandbox
https://firejail.wordpress.com
GNU General Public License v2.0
5.69k stars 557 forks source link

No network connection when using wireless interface #3000

Open Cris70 opened 4 years ago

Cris70 commented 4 years ago

When I use --net=wlp3s0 (my wifi interface) there is no network connection. I read elsewhere that wifi is not supported, but that was a few years ago... is it still true? If so, can it be enabled? I found a few articles on how to move a wireless interface into a namespace.

Thank you in advance!

Cris70 commented 4 years ago

Forgot to add details: firejail version 0.9.60 on openSUSE Tumbleweed (kernel 5.3.2)

Compile time support:

rusty-snake commented 4 years ago

For me it works with net wlpXs0 but only if I'm already connected.

Cris70 commented 4 years ago

@rusty-snake thank you for your comment. Unfortunately it doesn't work here, no matter the state of the connection. I'll post a screenshot tomorrow as soon as I can.

Cris70 commented 4 years ago

Sorry, forgot to send more information. Here is the output of the ifconfig command to show that wifi is up and connected, and then wget (with firejail) that cannot connect:

~ > ifconfig
enp0s25: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.24.252.51  netmask 255.255.252.0  broadcast 172.24.255.255
        inet6 fe80::3dca:33db:a8fe:80d0  prefixlen 64  scopeid 0x20<link>
        ether <amended>  txqueuelen 1000  (Ethernet)
        RX packets 1408808  bytes 693252364 (661.1 MiB)
        RX errors 0  dropped 69139  overruns 0  frame 0
        TX packets 324125  bytes 44978126 (42.8 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 20  memory 0xf0600000-f0620000

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 303690  bytes 423935884 (404.2 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 303690  bytes 423935884 (404.2 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.232.0.154  netmask 255.255.254.0  broadcast 10.232.1.255
        inet6 fe80::c66b:e3cc:4578:4601  prefixlen 64  scopeid 0x20<link>
        ether <amended>  txqueuelen 1000  (Ethernet)
        RX packets 1625  bytes 275978 (269.5 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1335  bytes 199957 (195.2 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

~ > LANG=C firejail --net=wlp3s0 wget http://hobbes.nmsu.edu/index.html
--2019-10-21 12:49:10--  http://hobbes.nmsu.edu/index.html
Resolving hobbes.nmsu.edu (hobbes.nmsu.edu)... 128.123.34.6
Connecting to hobbes.nmsu.edu (hobbes.nmsu.edu)|128.123.34.6|:80... failed: Network is unreachable.
netblue30 commented 4 years ago

Question: do you two have default routes set up, one for the regular ethernet interface and one for wlan? Maybe the sandbox is picking up the wrong one? Run this two commands:

# ip route show
# sudo firejail --net=wlp3s0 ip route show
Cris70 commented 4 years ago

Hi @netblue30 here are the results:

~> ip route show
default via 172.24.252.1 dev enp0s25 proto dhcp metric 20100
default via 10.232.0.1 dev wlp3s0 proto dhcp metric 20600
10.232.0.0/23 dev wlp3s0 proto kernel scope link src 10.232.0.154 metric 600
172.24.252.0/22 dev enp0s25 proto kernel scope link src 172.24.252.51 metric 100
~> sudo firejail --net=wlp3s0 ip route show
Error: cannot read UID_MIN and/or GID_MIN from /etc/login.defs, using 1000 by default
Reading profile /etc/firejail/server.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc

** Note: you can use --noprofile to disable server.profile **

Parent pid 5101, child pid 5102
The new log directory is /proc/5102/root/var/log

Interface        MAC                IP               Mask             Status
lo                                  127.0.0.1        255.0.0.0        UP
eth0-5101        e8:b1:fc:ac:2f:56  10.232.0.237     255.255.254.0    UP

Child process initialized in 1087.08 ms
10.232.0.0/23 dev eth0-5101 proto kernel scope link src 10.232.0.237

Parent is shutting down, bye...
glitsj16 commented 4 years ago

@netblue30 I'm going over the issues list to label things and I stumbled on this one. For me (with firejail from git master) this is still broken:

$ firejail --net=wlp2s0 /usr/bin/wget http://hobbes.nmsu.edu/index.html
--2020-01-20 23:42:07--  http://hobbes.nmsu.edu/index.html
Resolving hobbes.nmsu.edu (hobbes.nmsu.edu)... 128.123.88.139
Connecting to hobbes.nmsu.edu (hobbes.nmsu.edu)|128.123.88.139|:80... failed: Network is unreachable.

I'll mark it as a bug, but more importantly, is there any update on this?

Cris70 commented 4 years ago

No change here:

~ > LANG=C firejail --net=wlp3s0 /usr/bin/wget http://hobbes.nmsu.edu/index.html
Error: cannot read UID_MIN and/or GID_MIN from /etc/login.defs, using 1000 by default
--2020-01-22 09:10:34--  http://hobbes.nmsu.edu/index.html
Resolving hobbes.nmsu.edu (hobbes.nmsu.edu)... 128.123.88.139
Connecting to hobbes.nmsu.edu (hobbes.nmsu.edu)|128.123.88.139|:80... failed: Network is unreachable.

But I'm still using firejail 0.9.60: that's what openSuse Tumbleweed ships in his official repos.

matu3ba commented 4 years ago

@glitsj16 What OS do you use and is only wget broken for you?

@Cris70 Does the git master work for you? 0.9.60 is not a LTS, so the maintainers should ship 0.9.62.4

JsBergbau commented 3 years ago

For just binding to an Interface / forcing a program to access internet via a specific interface, have a look at bindToInterface https://github.com/JsBergbau/BindToInterface

This works with every network interface, including Wifi.

Cris70 commented 3 years ago

Update: I am using version 0.9.66 and I still have this issue.