Firejail

Security Advisory - Feb 8, 2021

Summary: A vulnerability resulting in root privilege escalation was discovered in
Firejail's OverlayFS code,

Versions affected: Firejail software versions starting with 0.9.30.
Long Term Support (LTS) Firejail branch is not affected by this bug.

Workaround: Disable overlayfs feature at runtime.
In a text editor open /etc/firejail/firejail.config file, and set "overlayfs" entry to "no".

      $ grep overlayfs /etc/firejail/firejail.config
      # Enable or disable overlayfs features, default enabled.
      overlayfs no

Fix: The bug is fixed in Firejail version 0.9.64.4

GitHub commit: (file configure.ac)
https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b

Credit:  Security researcher Roman Fiedler analyzed the code and discovered the vulnerability.
Functional PoC exploit code was provided to Firejail development team.
A description of the problem is here on Roman's blog:

https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt
https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/

$ git clone https://github.com/netblue30/firejail.git
$ cd firejail
$ ./configure && make && sudo make install-strip

$ sudo apt-get install git build-essential libapparmor-dev pkg-config gawk

$ firejail firefox            # starting Mozilla Firefox
$ firejail transmission-gtk   # starting Transmission BitTorrent
$ firejail vlc                # starting VideoLAN Client
$ sudo firejail /etc/init.d/nginx start

$ firejail --list
1617:netblue:/usr/bin/firejail /usr/bin/firefox-esr
7719:netblue:/usr/bin/firejail /usr/bin/transmission-qt
7779:netblue:/usr/bin/firejail /usr/bin/galculator
7874:netblue:/usr/bin/firejail /usr/bin/vlc --started-from-file file:///home/netblue/firejail-whitelist.mp4
7916:netblue:firejail --list

$ firecfg --fix-sound
$ sudo firecfg

JAILCHECK(1)                  JAILCHECK man page                  JAILCHECK(1)

NAME
       jailcheck - Simple utility program to test running sandboxes

SYNOPSIS
       sudo jailcheck [OPTIONS] [directory]

DESCRIPTION
       jailcheck attaches itself to all sandboxes started by the user and per‐
       forms some basic tests on the sandbox filesystem:

       1. Virtual directories
              jailcheck extracts a list with the main virtual directories  in‐
              stalled by the sandbox.  These directories are build by firejail
              at startup using --private* and --whitelist commands.

       2. Noexec test
              jailcheck inserts executable programs in  /home/username,  /tmp,
              and  /var/tmp  directories and tries to run them from inside the
              sandbox, thus testing if the directory is executable or not.

       3. Read access test
              jailcheck creates test files in the directories specified by the
              user and tries to read them from inside the sandbox.

       4. AppArmor test

       5. Seccomp test

       The program is started as root using sudo.

OPTIONS
       --debug
              Print debug messages.

       -?, --help
              Print options and exit.

       --version
              Print program version and exit.

       [directory]
              One  or  more  directories in user home to test for read access.
              ~/.ssh and ~/.gnupg are tested by default.

OUTPUT
       For each sandbox detected we print the following line:

            PID:USER:Sandbox Name:Command

       It is followed by relevant sandbox information, such as the virtual di‐
       rectories and various warnings.

EXAMPLE
       $ sudo jailcheck
       2014:netblue::firejail /usr/bin/gimp
          Virtual dirs: /tmp, /var/tmp, /dev, /usr/share,
          Warning: I can run programs in /home/netblue

       2055:netblue::firejail /usr/bin/ssh -X netblue@x.y.z.net
          Virtual dirs: /var/tmp, /dev, /usr/share, /run/user/1000,
          Warning: I can read ~/.ssh

       2186:netblue:libreoffice:firejail --appimage /opt/LibreOffice-fresh.ap‐
       pimage
          Virtual dirs: /tmp, /var/tmp, /dev,

       26090:netblue::/usr/bin/firejail /opt/firefox/firefox
          Virtual dirs: /home/netblue, /tmp, /var/tmp, /dev, /etc, /usr/share,
                        /run/user/1000,

       26160:netblue:tor:firejail --private=~/tor-browser_en-US ./start-tor
          Warning: AppArmor not enabled
          Virtual dirs: /home/netblue, /tmp, /var/tmp, /dev, /etc, /bin,
                        /usr/share, /run/user/1000,
          Warning: I can run programs in /home/netblue

LICENSE
       This program is free software; you can redistribute it and/or modify it
       under  the  terms of the GNU General Public License as published by the
       Free Software Foundation; either version 2 of the License, or (at  your
       option) any later version.

       Homepage: https://firejail.wordpress.com

SEE ALSO
       firejail(1),  firemon(1), firecfg(1), firejail-profile(5), firejail-lo‐
       gin(5), firejail-users(5),

0.9.65                             May 2021                       JAILCHECK(1)

$ sudo cp src/profstats/profstats /etc/firejail/.
$ cd /etc/firejail
$ ./profstats *.profile
Stats:
    profiles            1135
    include local profile   1135   (include profile-name.local)
    include globals     1106   (include globals.local)
    blacklist ~/.ssh        1009   (include disable-common.inc)
    seccomp         1035
    capabilities        1130
    noexec          1011   (include disable-exec.inc)
    noroot          944
    memory-deny-write-execute   242
    apparmor            667
    private-bin         635
    private-dev         992
    private-etc         508
    private-tmp         866
    whitelist home directory    542
    whitelist var       799   (include whitelist-var-common.inc)
    whitelist run/user      597   (include whitelist-runuser-common.inc
                    or blacklist ${RUNUSER})
    whitelist usr/share     569   (include whitelist-usr-share-common.inc
    net none            389
    dbus-user none      619
    dbus-user filter        105
    dbus-system none        770
    dbus-system filter      7