google-chrome: real home is accessible with --private= (dbus) #5246
Comments
|
chromium* uses portals for it's file dialog. Related/Duplicate of: #5032. |
|
firefox: Set |
|
OK, I can confirm that when I set It works without a package So I guess, it is not a plan to support that in a firejail, actually "the application" cannot access file content, just the "file picker". Some other links: |
see also #4716 |
kmk3
added
notabug
|
I have the same problem with google-chrome running in firejail on debian 11 (xfce4) using the option --private=folder. |
|
To pile on, I'm having a similar issue with google-chrome on Ubuntu 22.04.2 LTS. I confirmed it's running firejailed, yet the application is able to see the entirety of my disk, including the root directory. On a previous installation, it can only access the Downloads directory as one would expect. Do I need to take additional steps to limit what files Chrome can access? |
kmk3
changed the title
kmk3
changed the title
Description
google-chrome is able to access file list when using --private=FOLDER option
Steps to Reproduce
google-chrome-stable_current_amd64.debfrom https://google.com web pagedpkg -i google-chrome-stable_current_amd64.debmkdir -p ~/temp/youtube(can be any folder, but I used this one)cd ~/temp/youtubeps aux|grep -i chrom[e]|wc -l= 0firejail --private=$(pwd) --noprofile /usr/bin/google-chrome-stableCTRL+O(to open a file dialog)"Your file couldn’t be accessed,
It may have been moved, edited, or deleted.,
ERR_FILE_NOT_FOUND"
Expected behavior
When specify a command line option
--private=$FOLDER, then only files from a $FOLDER should be visible in a $HOME folder, "recently opened files should be only from $FOLDER (if there were some files opened previously)It looks like the issue is in "open file dialog" which have access to all files in my $HOME folder
Actual behavior
When specify a command line option
--private=$FOLDER, then all files from $HOME folder are visible in "open file dialog" and I can select a file. google chrome then display an error that file is not readableWhen trying to upload some file to virustotal, then file is uploaded successfully, but file size is 0 bytes (just to check whether it is possible read and upload a file using a javascript)
When open home folder as a URL in a google-chrome so
/home/lukyin my case, I see just expected content of my $FOLDER file, so this works correctly tooRunning without any profiles
Running using an existing profiles
--private=FOLDERAdditional context
Maybe it is related just to open file dialog and its caching, because when I click on a image file in "open file dialog" on a right side I see a small image preview. So it looks like that "open file dialog" is able to access file list and read file content to make a small image preview, but google-chrome itself cannot access a file content (as running with
--private=FOLDERcommand line option)firefox is using the same "open file dialog" and when I run:
then "open file dialog" in a firefox is not showing files from original $HOME folder, it is showing files from --private=$FOLDER, which is correct behavior
So it looks like that google-chrome is using "open file dialog" a different way and can escape from firejail container, which is wrong
Environment
kernel
Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)Log
Output of
LC_ALL=C firejail --private=`pwd` --noprofile /usr/bin/google-chrome-stableOutput of
LC_ALL=C firejail --debug --private=`pwd` --noprofile /usr/bin/google-chrome-stableThe text was updated successfully, but these errors were encountered: