dnsmasq: libvirtd cannot activate virtual network: PATH environment variable not set #6121
Comments
The upcoming Firejail release will have override support for firecfg.config: Lines 142 to 187 in b02a7a3 If you use firejail-git ftom the AUR you can have that functionality now. Dropping a file like the below will disable dnsmasq sandboxing persistently: $ cat /etc/firejail/firecfg.d/10-disabled.conf
!dnsmasq |
|
@glitsj16 ideally I'd like to keep using the dnsmasq profile. While this can be a temporary workaround, it does not solve the underlying issue |
|
@ShellCode33 Agreed, the underlying issue is still not very clear (to me). I've zero experience with libvirt/dnsmasq. Going over the referenced issue threads, I did notice #5089 (comment) mentions Have you tried using dnsmasq.profile with |
|
Follow-up I've installed libvirt/dnsmasq on my Arch Linux box to get a better understanding of this issue. With the below it works here, without the firecfg workaround: $ cat ~/.config/firejail/dnsmasq.local
# Firejail profile for dnsmasq
# Persistent local customizations
allusers
caps.keep chown,net_admin,net_bind_service,net_raw,setgid,setuid
ignore caps.keepCaveats:
@marek22k @ShellCode33 Can you try again with the above |
|
Thanks for taking the time to look at it @glitsj16 ! I still have the same PATH-related error: You said that for you virsh was just hanging, that sounds odd. Make sure the libvirtd service is running Here's my (I'm deliberately trying to be very permissive to narrow it down after, but that still doesn't work) |
|
@ShellCode33 $ sudo virsh net-start default
error: failed to connect to the hypervisor
error: Operation not supported: Cannot use direct socket mode if no URI is set@ShellCode33 @marek22k $ cat /usr/local/bin/dnsmasq
#!/bin/sh
#
## wrapper for dnsmasq
#+ sandbox support via firejail
### vars
_app="dnsmasq"
_bin="/usr/bin/${_app}"
# sandboxing
_bin="firejail --name=${_app}-6121 --quiet ${_bin}"
### logic
${_bin} "$@"
exit 0Mind the $ firejail --list | grep dnsmasq
11943:root:dnsmasq:firejail --name=dnsmasq-6121 --quiet /usr/bin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelperYou should see the same if you added Did any of you both added his user to the |
Yes it is currently enabled
Yes my user is part of this group, but I guess it doesn't matter considering we are running virsh using sudo, therefore polkit shouldn't be at play here I tried to put your script in place of the But now I have an apparmor denial 🥲
So I tried to disable this particular AppArmor profile, and now I observe the same behavior as you: virsh hangs. While it's still hanging, I can see it's running within firejail: EDIT: even if I CTRL+C virsh, dnsmasq is still running, but it's a bit annoying because all virsh commands hang, even EDIT2: my EDIT3: CTRL+C doesn't work, the libvirtd daemon will error after some time. And when it's automatically restarted by systemd, the following errors/warning are emitted: systemd logs |
kmk3
changed the title
kmk3
changed the title
kmk3
changed the title
|
FWIW I'm having the same issue on Arch. I don't use AppArmor. |
|
Same issue here on Arch. Disabled dnsmasq profile in firejail. Otherwise it won't function. |
There are multiple reports in netblue30#6121 that dnsmasq does not work when called by libvirt: $ sudo virsh net-start default error: Failed to start network default error: internal error: Child process (VIR_BRIDGE_NAME=virbr0 /usr/local/bin/dnsmasq [...]) unexpected exit status 1: Error: PATH environment variable not set Also, note that this is a server program, so it might be better to disable it by default anyway. Reported-by: @marek22k
There are multiple reports in #6121 that dnsmasq does not work when called by libvirt: $ sudo virsh net-start default error: Failed to start network default error: internal error: Child process (VIR_BRIDGE_NAME=virbr0 /usr/local/bin/dnsmasq [...]) unexpected exit status 1: Error: PATH environment variable not set Also, note that this is a server program, so it might be better to disable it by default anyway. Reported-by: @marek22k
This comment has been minimized.
This comment has been minimized.
Description
I cannot activate the virtual network when firejail is activated.
Steps to reproduce the behavior
sudo virsh net-start defaultExpected behavior
The network starts.
Actual behavior
The network does not start.
Behavior without a profile
Since dnsmasq is called by libvirt, it is difficult to do this manually. However, running it after
firecfg --cleanworks.Additional context
Already reported several times, but apparently not yet resolved:
Workaround:
Environment
firejail --version).Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.Log
Output of
LC_ALL=C firejail /path/to/programOutput of
LC_ALL=C firejail --debug /path/to/programhttps://gist.github.com/marek22k/53c067d5a7e23121984dd8b6b74ebb5a
The text was updated successfully, but these errors were encountered: