machine-id discrepancy in --help and what it actually does?

[svc88]

Its been stated in the firejail --help section -> --machine-id - preserve /etc/machine-id
So if using machine-id preserves the real /etc/machine-id then why when actually using it does it randomize it?
Also talked about under: https://firejail.wordpress.com/2021/01/21/firejail-tips-and-tricks/ that it randomizes the machine id.

Does using --machine-id in the profile or on terminal randomize /etc/machine-id or not?

Unless im missing something stupidly obvious here, then the help menu description of it is wrong?

[kmk3]

@svc88 on Nov 15:

Its been stated in the firejail --help section -> --machine-id - preserve
/etc/machine-id So if using machine-id preserves the real /etc/machine-id
then why when actually using it does it randomize it? Also talked about
under: https://firejail.wordpress.com/2021/01/21/firejail-tips-and-tricks/
that it randomizes the machine id.

This is what it does:

// spoof /etc/machine_id
void fs_machineid(void) {
	union machineid_t {
		uint8_t u8[16];
		uint32_t u32[4];
	} mid;

	// if --machine-id flag is inactive, do nothing
	if (arg_machineid == 0)
		return;
	if (arg_debug)
		printf("Generating a new machine-id\n");

From the current firejail(1) man page:

--machine-id
       Spoof id number in /etc/machine-id file - a new random id is generated
       inside the sandbox.  Note that this breaks audio  support.  Enable it
       when sound is not required.

       Example:
       $ firejail --machine-id

The help section seems wrong indeed:

$ firejail --help | grep machine-id
    --machine-id - preserve /etc/machine-id

And there are a few other places where it's written "preserve" as well.

Good catch; I'll send a PR for this.

[kmk3]

Good catch; I'll send a PR for this.

#4690

[svc88]

thanks.
i just want to confirm something that is confusing. Did --machine-id switch used to do the opposite and keep the real ID? Because i read an old comment by netblue30 here: #955 (comment)

[kmk3]

@svc88 on Nov 17:

thanks. i just want to confirm something that is confusing. Did
--machine-id switch used to do the opposite and keep the real ID? Because i
read an old comment by netblue30 here: #955
(comment)

The first commit related to machine-id that I found is commit d0cc960
("spoof machine-id", 2016-12-05), which effectively spoofs the id (but in some
code that it adds it claims to preserve the id; see #4690). From a cursory
glance at the history, I don't think that the option ever preserved the id. My
guess is that @netblue30 originally intended to add an option to preserve the
id, but then changed it to spoof the id instead.