Why does firejail fail to execute if ~/.asoundrc is a symlink?

[amano-kenji]

If ~/.asoundrc is a symlink, I see this error message.

Error: Cannot access /home/user/.asoundrc
Error: proc 29441 cannot sync with peer: unexpected EOF

Why?

[rusty-snake]

Where does it point to?
Which commands do you use?

[amano-kenji]

I hate this restriction.

[amano-kenji]

Is there any elegant configuration management system?

[rusty-snake]

What do you mean with "configuration management system"?

[amano-kenji]

I chose ansible as my simple configuration management system for synchronizing dotfiles between my home directory and a git repository.

~/.asoundrc can go out of sync between directories without configuration management system like ansible.

[amano-kenji]

Do we need to restrict a symlink in HOME from pointing to a file outside home directory?

[rusty-snake]

Did you search for it?

Is it the same as #4529 (#4527)?

[smitsohu]

It looks like Firejail only answers half of the question at the moment.

It is probably not wrong to reject copying a file from outside $HOME to a tmpfs mounted on $HOME, but if Firejail does not copy the file it could perhaps just recreate the symbolic link? If .asoundrc is under control of the user already, it doesn't make a difference which symlink is created by Firejail. If .asoundrc is not under control of the user, Firejail could just 1:1 reproduce the symbolic link.

I hate this restriction.

Understood.

[netblue30]

I'll remove the restriction, so you can link wherever, as long as the file pointed by the symlink is owned by the user running the sandbox.

Any other similar files/problems, just let us know.

[amano-kenji]

Thank you.

[netblue30]

Should be fixed now on mainline, you can try it out.

66ad14e
66f8107

[amano-kenji]

Why do you have code specifically for ~/.asoundrc?

[amano-kenji]

Anyway, I tried it. It works.

[netblue30]

There are actually 3 of them: .asoundrc, .Xauthority, and .config/pulse. We also bring in from /etc/skel a .bashrc, or a .zshrc, or a .cshrc. And after all this is done we generate a new .inputrc. It looks like this:

$ firejail --private --quiet
$ ls -al
total 12
drwx------ 3 netblue netblue  140 Mar  9 22:59 .
drwxr-xr-x 3 nobody  nogroup   60 Mar  9 22:59 ..
-rw------- 1 netblue netblue    0 Mar  9 22:59 .asoundrc
-rw-r--r-- 1 netblue netblue 3526 Mar  9 22:59 .bashrc
drwx------ 3 netblue netblue   60 Mar  9 22:59 .config
-rw-r--r-- 1 netblue netblue   26 Mar  9 22:59 .inputrc
-rw------- 1 netblue netblue  155 Mar  9 22:59 .Xauthority

[netblue30]

Anyway, I tried it. It works.

OK, thanks. I'll mark it as resolved on mainline.