New profile: luarocks #4596

matu3ba · 2021-10-07T20:45:18Z

DO NOT MERGE! Please review.

MERGE BLOCKER: firecfg does not create the necessary symlink in
/usr/local/bin
/usr/bin/luarocks however is a proper working binary.

Another annoyance from this: Neovim has a package manager called packer,
which pollutes $HOME with manifest-5-[1-4].zip and a pile of .rockspec
and .src.rock files.

DO NOT MERGE! Please review. MERGE BLOCKER: firecfg does not create the necessary symlink in /usr/local/bin /usr/bin/luarocks however is a proper working binary. Another annoyance from this: Neovim has a package manager called packer, which pollutes $HOME with manifest-5-[1-4].zip and a pile of .rockspec and .src.rock files.

matu3ba · 2021-10-07T20:47:08Z

If anyone has an idea that would be great. I do also have a profile for neovim that depends on luarocks working properly.

I noticed the same issue for vim: /usr/local/bin is not created for me. With firejail vim /var/log/pacman.log an empty file is opened. Even though vim is in /usr/bin/vim.

smitsohu · 2021-10-07T23:31:16Z

Closed by accident!

If you create the symbolic link manually, does it work as expected?

sudo ln -s /usr/bin/firejail /usr/local/bin/luarocks

In other words, is this an issue with firecfg or an issue with the sandbox?

rusty-snake · 2021-10-08T06:03:02Z

firecfg does not create the necessary symlink in /usr/local/bin
I noticed the same issue for vim: /usr/local/bin is not created for me.

If you do not add luarocks to firecfg.config, firecfg will not create symlinks.

rusty-snake

A first review (without hardening suggestions).

etc/profile-a-l/luarocks.profile

Co-authored-by: rusty-snake <[email protected]>

rusty-snake

Second round, hardening suggestions.

etc/profile-a-l/luarocks.profile

noblacklist in allow-lua.inc must corresponds to blacklist section for lua in disable-interpreters.inc

Co-authored-by: rusty-snake <[email protected]>

etc/inc/allow-lua.inc

etc/inc/disable-interpreters.inc

* disable /run/user/userid * use well tested whitelist-usr-share-common.inc * use disable-X11.inc

* dont break various application sandboxes with noblacklist /usr/include/lua* Instead insert it manually for luarocks. * remove redundant `blacklist /usr/share/lua` from disable-interpreters.inc

etc/profile-a-l/luarocks.profile

matu3ba · 2021-10-08T12:59:16Z

@rusty-snake Can I rebase, squash and force-push with you as co-author and the following text or do you think more changes are needed?

Add profile for luarocks

Co-authored-by: rusty-snake <[email protected]>

rusty-snake · 2021-10-08T13:07:57Z

src/firecfg/firecfg.config

@@ -481,6 +481,7 @@ lowriter
 # lrzip - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
 # lrztar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
 # lrzuntar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
+luarocks


Needs discussion: Do we want to firecfg build-systems/package-managers by default? (related: #4519)

Status quo of the default profile is very undesirable, because luarocks search does not update the package list.
Both options are annoying to some degree:

If sandboxed on default, luarocks may have too few privileges to invoke external compilers ie to compile luaformat

If not sandboxed, evil lua programs/plugins in neovim may trivially invoke luarocks to do bad stuff.

rusty-snake · 2021-10-08T13:08:32Z

etc/inc/allow-lua.inc

-noblacklist /usr/share/lua
 noblacklist /usr/share/lua*


I need to check why there was these two.

rusty-snake · 2021-10-08T13:14:57Z

etc/profile-a-l/luarocks.profile

+# Disallow blocking access to Lua header files.
+noblacklist /usr/include/lua*


#4596 (comment)

When is /usr/include/lua… used? Current behaviour of allow-lua.inc is strange, allow /usr/include but not /usr/include/lua*.

Currently this is how we handle /usr/include:

$ grep /usr/include /etc/firejail/* /etc/firejail/allow-lua.inc:noblacklist /usr/include /etc/firejail/allow-nodejs.inc:noblacklist /usr/include/node /etc/firejail/allow-python2.inc:noblacklist /usr/include/python2* /etc/firejail/allow-python3.inc:noblacklist /usr/include/python3* /etc/firejail/disable-devel.inc:blacklist /usr/include /etc/firejail/disable-interpreters.inc:blacklist /usr/include/lua* /etc/firejail/disable-interpreters.inc:blacklist /usr/include/node /etc/firejail/disable-interpreters.inc:blacklist /usr/include/python2* /etc/firejail/disable-interpreters.inc:blacklist /usr/include/python3* /etc/firejail/hashcat.profile:noblacklist /usr/include

rusty-snake · 2021-10-08T13:15:16Z

etc/profile-a-l/luarocks.profile

+whitelist ${HOME}/.netrc
+whitelist ${HOME}/.config/pkcs11
+whitelist ${HOME}/.wget-hsts
+whitelist ${HOME}/.cache/luarocks
+whitelist ${HOME}/luarocks/cmd/external
+whitelist ${HOME}/.nix-profile/bin
+whitelist ${HOME}/.luarocks
+whitelist ${HOME}/.config/luarocks


Missing mkdir/mkfile for some of them.

rusty-snake · 2021-10-08T13:15:45Z

etc/profile-a-l/luarocks.profile

+whitelist ${HOME}/luarocks/cmd/external
+whitelist ${HOME}/.nix-profile/bin
+whitelist ${HOME}/.luarocks
+whitelist ${HOME}/.config/luarocks


Missing blacklist/noblacklist/read-only for some of them.

rusty-snake · 2021-10-08T13:16:09Z

etc/profile-a-l/luarocks.profile

+
+whitelist ${HOME}/.netrc
+whitelist ${HOME}/.config/pkcs11
+whitelist ${HOME}/.wget-hsts


Is this necessary?

edit: this line: whitelist ${HOME}/.wget-hsts

rusty-snake · 2021-10-08T13:16:26Z

etc/profile-a-l/luarocks.profile

+whitelist ${HOME}/.netrc
+whitelist ${HOME}/.config/pkcs11
+whitelist ${HOME}/.wget-hsts
+whitelist ${HOME}/.cache/luarocks
+whitelist ${HOME}/luarocks/cmd/external
+whitelist ${HOME}/.nix-profile/bin
+whitelist ${HOME}/.luarocks
+whitelist ${HOME}/.config/luarocks


Needs discussion: Missing wc.

rusty-snake · 2021-10-08T13:17:04Z

etc/profile-a-l/luarocks.profile

+whitelist ${HOME}/.netrc
+whitelist ${HOME}/.config/pkcs11
+whitelist ${HOME}/.wget-hsts
+whitelist ${HOME}/.cache/luarocks
+whitelist ${HOME}/luarocks/cmd/external
+whitelist ${HOME}/.nix-profile/bin
+whitelist ${HOME}/.luarocks
+whitelist ${HOME}/.config/luarocks


Needs discussion: Do we want to use whitelisting for package-managers/build-systems by default.

rusty-snake · 2021-10-08T13:18:56Z

etc/profile-a-l/luarocks.profile

+whitelist ${HOME}/.config/pkcs11
+whitelist ${HOME}/.wget-hsts
+whitelist ${HOME}/.cache/luarocks
+whitelist ${HOME}/luarocks/cmd/external


Nothing else from ~/luarocks required?

The answer to this question depends on "Needs discussion: Do we want to firecfg build-systems/package-managers by default? (related: #4519)".
To what degree does firejail want to allow invoking build systems or running stuff from a package manager (which sounds like bad security practice).

matu3ba · 2022-05-05T10:10:23Z

User experience:
building neovim, which builds packer to invoke it fails with:

cd /home/user/dev/git/c/neovim/.deps && /home/user/dev/git/c/neovim/.deps/usr/bin/luarocks build nvim-client 0.2.3-1 CC=/usr/bin/cc LD=/usr/bin/cc

Error: Could not find a result named nvim-client 0.2.3-1: No results matching query were found for Lua 5.1.
To check if it is available for other Lua versions, use --check-lua-versions.
[user@pc .deps]$ cd /home/user/dev/git/c/neovim/.deps && /home/user/dev/git/c/neovim/.deps/usr/bin/luarocks install nvim-client 0.2.3-1 CC=/usr/bin/cc LD=/usr/bin/cc

There is a manifest.zip file written to $HOME, which contains this info. Also $HOME is cluttered with *src.rock and *.rockspec files.

matu3ba

ups, I forgot to click "Submit review".

etc/profile-a-l/luarocks.profile

matu3ba · 2022-05-05T10:02:30Z

src/firecfg/firecfg.config

@@ -481,6 +481,7 @@ lowriter
 # lrzip - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
 # lrztar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
 # lrzuntar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
+luarocks


Status quo of the default profile is very undesirable, because luarocks search does not update the package list.
Both options are annoying to some degree:

If sandboxed on default, luarocks may have too few privileges to invoke external compilers ie to compile luaformat

If not sandboxed, evil lua programs/plugins in neovim may trivially invoke luarocks to do bad stuff.

matu3ba · 2022-05-05T10:05:21Z

etc/profile-a-l/luarocks.profile

+whitelist ${HOME}/.config/pkcs11
+whitelist ${HOME}/.wget-hsts
+whitelist ${HOME}/.cache/luarocks
+whitelist ${HOME}/luarocks/cmd/external


The answer to this question depends on "Needs discussion: Do we want to firecfg build-systems/package-managers by default? (related: #4519)".
To what degree does firejail want to allow invoking build systems or running stuff from a package manager (which sounds like bad security practice).

smitsohu closed this Oct 7, 2021

smitsohu reopened this Oct 7, 2021

rusty-snake marked this pull request as draft October 8, 2021 06:04

rusty-snake requested changes Oct 8, 2021

View reviewed changes

matu3ba and others added 5 commits October 8, 2021 08:54

use allow-lua as its smaller.

eb7dab0

Co-authored-by: rusty-snake <[email protected]>

remove disable-write-mnt

4e670d2

Co-authored-by: rusty-snake <[email protected]>

shortening (default-disabled) private-etc

5df4c63

Co-authored-by: rusty-snake <[email protected]>

remove private-bin and s/allow/whitelist

f6f0021

add luarocks to firecfg.config

65242d9

rusty-snake reviewed Oct 8, 2021

View reviewed changes

etc/profile-a-l/luarocks.profile Show resolved Hide resolved

etc/profile-a-l/luarocks.profile Show resolved Hide resolved

etc/profile-a-l/luarocks.profile Show resolved Hide resolved

etc/profile-a-l/luarocks.profile Show resolved Hide resolved

matu3ba and others added 2 commits October 8, 2021 09:35

fix allow-lua.inc and disable-interpreters.inc

4c5ca65

noblacklist in allow-lua.inc must corresponds to blacklist section for lua in disable-interpreters.inc

add seccomp.block-secondary

161df63

Co-authored-by: rusty-snake <[email protected]>

rusty-snake requested changes Oct 8, 2021

View reviewed changes

etc/inc/allow-lua.inc Outdated Show resolved Hide resolved

etc/inc/disable-interpreters.inc Outdated Show resolved Hide resolved

matu3ba added 3 commits October 8, 2021 10:00

update luarocks profile

29ef011

* disable /run/user/userid * use well tested whitelist-usr-share-common.inc * use disable-X11.inc

Merge branch 'luarocks' of github.com:matu3ba/firejail into luarocks

e610d2e

update luarocks profile

f3e9ea0

* dont break various application sandboxes with noblacklist /usr/include/lua* Instead insert it manually for luarocks. * remove redundant `blacklist /usr/share/lua` from disable-interpreters.inc

rusty-snake reviewed Oct 8, 2021

View reviewed changes

etc/profile-a-l/luarocks.profile Outdated Show resolved Hide resolved

matu3ba added 2 commits October 8, 2021 10:41

add whitelist-var-common and whitelist-run-common

ce1b231

fix order

1d1f524

rusty-snake reviewed Oct 8, 2021

View reviewed changes

rusty-snake reviewed Oct 9, 2021

View reviewed changes

matu3ba commented Jul 25, 2023

View reviewed changes

kmk3 changed the title ~~Add profile for luarocks~~ New profile: luarocks Aug 25, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

New profile: luarocks #4596

New profile: luarocks #4596

matu3ba commented Oct 7, 2021

matu3ba commented Oct 7, 2021 •

edited

Loading

smitsohu commented Oct 7, 2021 •

edited

Loading

rusty-snake commented Oct 8, 2021

rusty-snake left a comment

rusty-snake left a comment

matu3ba commented Oct 8, 2021

rusty-snake Oct 8, 2021

matu3ba May 5, 2022

rusty-snake Oct 8, 2021

rusty-snake Oct 8, 2021

rusty-snake Oct 8, 2021

rusty-snake Oct 8, 2021

rusty-snake Oct 8, 2021 •

edited

Loading

rusty-snake Oct 8, 2021

rusty-snake Oct 8, 2021

rusty-snake Oct 8, 2021

matu3ba May 5, 2022

matu3ba commented May 5, 2022

matu3ba left a comment

matu3ba May 5, 2022

matu3ba May 5, 2022

		# Disallow blocking access to Lua header files.
		noblacklist /usr/include/lua*

New profile: luarocks #4596

Are you sure you want to change the base?

New profile: luarocks #4596

Conversation

matu3ba commented Oct 7, 2021

matu3ba commented Oct 7, 2021 • edited Loading

smitsohu commented Oct 7, 2021 • edited Loading

rusty-snake commented Oct 8, 2021

rusty-snake left a comment

Choose a reason for hiding this comment

rusty-snake left a comment

Choose a reason for hiding this comment

matu3ba commented Oct 8, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rusty-snake Oct 8, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

matu3ba commented May 5, 2022

matu3ba left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

matu3ba commented Oct 7, 2021 •

edited

Loading

smitsohu commented Oct 7, 2021 •

edited

Loading

rusty-snake Oct 8, 2021 •

edited

Loading