private-cwd leaks access to the entire filesystem

[WhyNotHugo]

Description

Using firejail --private --private-cwd=. /usr/bin/sh leaks access to the entire filesystem.

Steps to Reproduce

1. cd into some subdirectory of $HOME.
2. `firejail --private --private-cwd=. /usr/bin/sh
3. ls ../../some-file (for a relative path that exists). cat also works.

Expected behavior

Access to these files should not be possible.

Actual behavior

Access to files using relative paths is permitted, allowing access to the entire filesystem.

Note: changing directory into those locations does not work, but reading files without changing directory does.

Behavior without a profile

n/a

Additional context

Environment

➜ uname -sro
Linux 5.15.8-arch1-1 GNU/Linux

➜ firejail --version
firejail version 0.9.67

Compile time support:
	- always force nonewprivs support is disabled
	- AppArmor support is enabled
	- AppImage support is enabled
	- chroot support is enabled
	- D-BUS proxy support is enabled
	- file transfer support is enabled
	- firetunnel support is enabled
	- networking support is enabled
	- output logging is enabled
	- overlayfs support is disabled
	- private-home support is enabled
	- private-cache and tmpfs as user enabled
	- SELinux support is disabled
	- user namespace support is enabled
	- X11 sandboxing support is enabled

Checklist

(removed some non-applicable items)

• I have performed a short search for similar issues (to avoid opening a duplicate).
  • I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.

[glitsj16]

@WhyNotHugo Nice find! Thanks for reporting.

@rusty-snake I'm new to marking issues to a milestone. Any thoughts on adding this to 0.9.68? Even when this isn't fixed by then (whenever it comes), it's a nice way to keep track of things.

[netblue30]

Fixed: d2e10f8

Very cool bug, thanks!

[WhyNotHugo]

The command in the example above no longer works:

$ firejail --private --private-cwd=. /usr/bin/sh
Error: invalid private working directory

[kmk3]

@WhyNotHugo commented on Dec 20:

The command in the example above no longer works:

$ firejail --private --private-cwd=. /usr/bin/sh
Error: invalid private working directory

Hello, could you open a new issue for this?

[Ding-yixia]

这个问题还没有修复