Bug 387215 - KDE Let Applications Escape Firejail's Sandbox
Summary: KDE Let Applications Escape Firejail's Sandbox
Status: RESOLVED WORKSFORME
Alias: None
Product: frameworks-kio
Classification: Frameworks and Libraries
Component: general (show other bugs)
Version: unspecified
Platform: Manjaro Linux
: NOR major
Target Milestone: ---
Assignee: Dolphin Bug Assignee
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-11-22 16:50 UTC by T R T
Modified: 2023-01-01 05:20 UTC (History)
5 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description T R T 2017-11-22 16:50:57 UTC
I've tried both Dolphin and KMozillaHelper(Firefox) and they escape their sandboxes through KDE's services. This is probably the fault of Xorg too but KDE should NOT share the FS like this.
Comment 1 GOD 2017-11-22 23:47:56 UTC
There are many ways to bring the dedicated source files to a way that many can believe they are real.  If they are not real then they need to be deleted from the base file list rather than get a new one.  Thanks for the efforts!
Comment 2 Christoph Feck 2017-12-11 13:45:49 UTC
Please when reporting bugs add the following information:

- Exact steps to reproduce
- What you expect to see
- What you see instead

'KDE' is a community, and you have to be more clear what type of KDE software you are using and what issue you get exactly.
Comment 3 Christoph Feck 2018-01-02 15:12:51 UTC
If you can provide the information requested in comment #2, please add it.
Comment 4 T R T 2018-01-12 11:41:50 UTC
I don't know what you've failed to understand. KDE services(like KIO) help programs escape the sandbox. How to reproduce? Sandbox a KDE app and try to select files with KDE's file dialog. If the sandboxed app's *directory structure matches* with yours then the app will get its hand on the FS.
firefox with gnome's file chooser doesn't escape the sandbox. firefox-kde does. The rest of the KDE apps can't be properly sandboxed either.
See this reddit thread when someone else also experienced the same: https://www.reddit.com/r/kde/comments/7pl325/how_does_kio_work/
Comment 5 Christoph Feck 2018-01-12 11:51:32 UTC
> Sandbox a KDE app

How? Please add exact steps to reproduce. Assuming you are using Linux, there are several tools to restrict file system access, and we need more information which setup you are using, and why it fails with KDE applications but not with other applications.
Comment 6 T R T 2018-01-12 12:02:07 UTC
By using either firejail or flatpak(the backend is bubblewrap) - these are the most popular sandboxing solutions. I guess KIO provides a global file dialog for every X app and if an application connects to X(and KDE) KIO can leak files. 
For example:

I fake a home dir with `firejail --private=~/FF_jail firefox -no-remote`

then I have a 'Documents' folder both in the sandbox and in my home dir

and if I've firefox-kde - which uses KDE's file dialog instead of gnome's 

then KIO will show me MY home dir - and if the 'Documents' folder is present in both then the sandbox will be able to read the content from outside.


Another example:


If I open dolphin with `firejail --private=~/dj dolphin` then it'll be able to access almost everything.



I'd try okular with firejail but it crashes with:

"
mprotect failed in ExecutableAllocator::makeExecutable: Access denied                                                                                                                            
*** stack smashing detected ***: <unknown> terminated
"
Comment 7 T R T 2018-01-12 12:11:10 UTC
Another thing: I've used the experimental KDE+flatpak repo to try the flatpakked KDE apps. I haven't tried them today.
Comment 8 Christoph Feck 2018-01-17 20:13:33 UTC
Reassigning to KIO developers for inspection.
Comment 9 kalomel 2018-08-23 19:03:11 UTC
As long as there is access to D-Bus, not your sandboxed application, but the kdeinit5 process running outside the sandbox forks the KIO slave, which leads to the issue you described.

To work around this, deny the firejail sandbox access to the D-Bus session bus, for example by passing --blacklist=/run/user/$UID/bus on the command line. Then open a file dialog, and you see that there is no escape from the sandbox any more.

If you inspect this firejail sandbox in another terminal with 
$ firejail --tree

you'll find that the KIO slave now is running inside the sandbox, as a child process of your KDE app.

Anyways, this is only part of the picture. To sandbox applications in rich desktop environments like KDE or Gnome, you should *always* deny access to the D-Bus session bus. From the perspective of sandboxing, D-Bus is a nightmare, and Gnome doesn't really expose less attack surface than KDE.
Comment 10 Justin Zobel 2022-12-02 01:22:44 UTC
Thank you for reporting this issue in KDE software. As it has been a while since this issue was reported, can we please ask you to see if you can reproduce the issue with a recent software version?

If you can reproduce the issue, please change the status to "REPORTED" when replying. Thank you!
Comment 11 Bug Janitor Service 2022-12-17 05:13:41 UTC
Dear Bug Submitter,

This bug has been in NEEDSINFO status with no change for at least
15 days. Please provide the requested information as soon as
possible and set the bug status as REPORTED. Due to regular bug
tracker maintenance, if the bug is still in NEEDSINFO status with
no change in 30 days the bug will be closed as RESOLVED > WORKSFORME
due to lack of needed information.

For more information about our bug triaging procedures please read the
wiki located here:
https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging

If you have already provided the requested information, please
mark the bug as REPORTED so that the KDE team knows that the bug is
ready to be confirmed.

Thank you for helping us make KDE software even better for everyone!
Comment 12 Bug Janitor Service 2023-01-01 05:20:19 UTC
This bug has been in NEEDSINFO status with no change for at least
30 days. The bug is now closed as RESOLVED > WORKSFORME
due to lack of needed information.

For more information about our bug triaging procedures please read the
wiki located here:
https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging

Thank you for helping us make KDE software even better for everyone!