flutter: program can access the internet even with --net=none

[gcb]

I was always under the impression that forking in a firejail would inherit the restrictions, but when experimenting with jailing flutter with no net, i saw it call git and access the remote repo.

I started with

firejail --net=none --trace /opt/flutter/bin/flutter --version

(with --nettrace) i see:
  144 B/s  **                    185.199.111.154:443(TLS) GitHub

And after exec'ing git, it had access to the remote.

with the next command, it seems it couldn't access the remote.

firejail --noprofile --net=none --trace /opt/flutter/bin/flutter --version

I'm pretty sure there is a very obvious wiki or doc page or code comment I should be reading but I can't find anything.

[rusty-snake]

And after exec'ing git, it had access to the remote.

How do you know?

I was always under the impression that forking in a firejail would inherit the restrictions

Correct

[gcb]

How do you know?

It showed me the new version available which is does by fetching the remote repo tags.

[gcb]

Ok, i'm questioning it now

$ firejail  --net=none  flutter -v upgrade
...
29:git:exec /usr/bin/git:0
...
[   +2 ms] executing: [/opt/flutter/] git fetch --tags
[  +27 ms] fatal: unable to access 'https://github.com/flutter/flutter.git/': Could not resolve host: github.com

maybe i did update the remotes months ago and it was using that for the version message, so it was just fs access.

Thanks for the sanity check 👍