search

netblue30 / firejail

Linux namespaces and seccomp-bpf sandbox
https://firejail.wordpress.com
GNU General Public License v2.0
5.68k stars 556 forks source link

youtube-dl and ffprobe requires libblas.so #3506

Open hyiltiz opened 4 years ago

hyiltiz commented 4 years ago

Write clear, concise and in textual form.

Bug and expected behavior

No profile or disabling firejail

Reproduce Steps to reproduce the behavior:

  1. Run in bash firejail youtube-dl -x SOMELINK or firejail ffprobe SOMEFILE
  2. See error: 
    
> firejail ffprobe SOMEFILE.webm
Error fcopy: size limit of 500 MB reached
Error getpwuid: main.c:294 init_cfg: No such file or directory

ffprobe SOMEFILE.webm Error fcopy: size limit of 500 MB reached /usr/bin/ffprobe: error while loading shared libraries: libblas.so.3: cannot open shared object file: No such file or directory

/usr/bin/ffprobe SOMEFILE.webm ffprobe version 4.3-2 Copyright (c) 2007-2020 the FFmpeg developers built with gcc 9 (Debian 9.3.0-13) ...

Environment

Compile time support:

Checklist

OUTPUT OF `firejail --debug PROGRAM`
https://termbin.com/3iou

BTW, I just noticed that the above firejail --debug provided way too much information about my filesystem and setup. Was that necessary? If so, please consider creating a key pair and uploading your public key so these kinds of probably sensitive private information can be shared directly with the project without putting it up in the Internet indefinitely in plain text.

hyiltiz commented 3 years ago

Ok, I'll try to summarize.

In all cases, directly calling the program with something like /usr/bin/okular or /usr/bin/ffmpeg will resolve the issue, unless that command then calls another program that has a firejail profile (like youtube-dl calls ffmpeg which has a profile). I'd rather not throw away the firejail profiles all the time, but not sure how to work around it.

I have apparmor running, although none of the mentioned programs above are listed in aa-status, so not sure if apparmor is relevant.

rusty-snake commented 3 years ago

didn't bothered to properly mask the i386 libraries, and the x86-64 binaries accidentally found the i386 libraries when invoked with firejail which masked x86-64?

blacklist /usr/lib/i386-linux-gnu (or where else debian has i386 libs) can be used to test this.

it seems some specific list in private-etc and/or private-bin for them both may resolve this issue, but unsure what (this was ongoing investigation and I am still awaiting response to my test above)

So if you add ignore private-bin and ignore private-etc to ffmpeg.local and youtube-dl.local it works?

hyiltiz commented 3 years ago

So if you add ignore private-bin and ignore private-etc to ffmpeg.local and youtube-dl.local it works?

Yes. I'd rather not ignore them, so I think we've been bisecting a list of things to ignore above.

blacklist /usr/lib/i386-linux-gnu (or where else debian has i386 libs) can be used to test this.

Added blacklist /usr/lib/i386-linux-gnu to okular.local but still gives the same error message. Guess the assumption wasn't correct.

rusty-snake commented 3 years ago

So if you add ignore private-bin and ignore private-etc to ffmpeg.local and youtube-dl.local it works?

Yes. I'd rather not ignore them, so I think we've been bisecting a list of things to ignore above.

That right, but no narrow it down I asked if it works if they are ignored.

Assuming that adding only one of the ignores still breaks (i.e. both are necessary):

1ras commented 1 year ago

Regarding libblas.so, this is because "private-etc alternatives" provides now an incomplete alternatives directory (this was not the case in the past):

Native system:

$ ls -l /usr/lib/x86_64-linux-gnu/libblas.so.3
lrwxrwxrwx 1 root root 47  2. Sep 2019  /usr/lib/x86_64-linux-gnu/libblas.so.3 -> /etc/alternatives/libblas.so.3-x86_64-linux-gnu
$ ls -l /etc/alternatives/libblas.so.3-x86_64-linux-gnu
lrwxrwxrwx 1 root root 55 22. Aug 22:48 /etc/alternatives/libblas.so.3-x86_64-linux-gnu -> /usr/lib/x86_64-linux-gnu/openblas-pthread/libblas.so.3
$ ls -l /usr/lib/x86_64-linux-gnu/openblas-pthread/libblas.so.3
-rw-r--r-- 1 root root 399704 19. Dez 2022  /usr/lib/x86_64-linux-gnu/openblas-pthread/libblas.so.3

Inside Firejail:

$ ls -l /usr/lib/x86_64-linux-gnu/libblas.so.3
lrwxrwxrwx 1 nobody 65534 47  2. Sep 2019  /usr/lib/x86_64-linux-gnu/libblas.so.3 -> /etc/alternatives/libblas.so.3-x86_64-linux-gnu
$ LANG=C  ls -l /etc/alternatives/libblas.so.3-x86_64-linux-gnu
ls: cannot access '/etc/alternatives/libblas.so.3-x86_64-linux-gnu': No such file or directory
$ ls -l /usr/lib/x86_64-linux-gnu/openblas-pthread/libblas.so.3
-rw-r--r-- 1 nobody 65534 399704 19. Dez 2022  /usr/lib/x86_64-linux-gnu/openblas-pthread/libblas.so.3

Same issue with wine executables:

Native system:

$ ls -l /usr/bin/wine
lrwxrwxrwx 1 root root 22 18. Feb 2023  /usr/bin/wine -> /etc/alternatives/wine
$ ls -l /etc/alternatives/wine
lrwxrwxrwx 1 root root 20 18. Feb 2023  /etc/alternatives/wine -> /usr/bin/wine-stable
$ ls -l /usr/bin/wine-stable
-rwxr-xr-x 1 root root 1029 18. Feb 2023  /usr/bin/wine-stable

Inside Firejail:

$ ls -l /usr/bin/wine
lrwxrwxrwx 1 nobody 65534 22 18. Feb 2023  /usr/bin/wine -> /etc/alternatives/wine
$ LANG=C ls -l /etc/alternatives/wine
ls: cannot access '/etc/alternatives/wine': No such file or directory
$ ls -l /usr/bin/wine-stable
-rwxr-xr-x 1 nobody 65534 1029 18. Feb 2023  /usr/bin/wine-stable

For some reason /etc/alternatives is incomplete with "private-etc alternatives". Some links are still available, others are missing. I can see no good reason why symlinks to installed software are "randomly" removed.

This affects Debian Bookworm, firejail 0.9.72.

kmk3 commented 1 year ago

Regarding libblas.so, this is because "private-etc alternatives" provides now an incomplete alternatives directory (this was not the case in the past):

This may potentially be fixed by: