[GH-ISSUE #1586] gnome-ring can't interact with dring

gitea-mirror commented

2026-05-05 07:22:37 -06:00

Owner

Originally created by @PharmaceuticalCobweb on GitHub (Oct 2, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1586

Hi, I submitted a commit a few days ago to add support for gnome-ring. However, there are some issues currently. When gnome-ring starts it opens both a front-end, graphical environment but also starts a background process/daemon called "dring".

Right now if you open gnome-ring in firejail (using default restrictive settings or the profile I wrote) it will start dring and gnome-ring in two different firejail sandboxes. As a result gnome-ring can't interact with dring and claims that the user doesn't have an account, since it can't see any.

To fix this gnome-ring and dring would need to start in the same firejail sandbox rather than two separate ones. However, I'm not sure how to do that.

Originally created by @PharmaceuticalCobweb on GitHub (Oct 2, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1586 Hi, I submitted a commit a few days ago to add support for gnome-ring. However, there are some issues currently. When gnome-ring starts it opens both a front-end, graphical environment but also starts a background process/daemon called "dring". Right now if you open gnome-ring in firejail (using default restrictive settings or the profile I wrote) it will start dring and gnome-ring in two different firejail sandboxes. As a result gnome-ring can't interact with dring and claims that the user doesn't have an account, since it can't see any. To fix this gnome-ring and dring would need to start in the same firejail sandbox rather than two separate ones. However, I'm not sure how to do that.

gitea-mirror closed this issue

2026-05-05 07:22:38 -06:00

gitea-mirror commented

2026-05-05 07:22:41 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Oct 2, 2017):

Can you fully close/stop both processes, add the following to the profile file join-or-start ring and then try starting it. That should make it so there is only ever one sandbox. If that works, I'll add it to the profile.

@SkewedZeppelin commented on GitHub (Oct 2, 2017): Can you fully close/stop both processes, add the following to the profile file `join-or-start ring` and then try starting it. That should make it so there is only ever one sandbox. If that works, I'll add it to the profile.

gitea-mirror commented

2026-05-05 07:22:42 -06:00

Author

Owner

@PharmaceuticalCobweb commented on GitHub (Oct 2, 2017):

I added join-or-start ring to my profile and they still start separately. Also tried join-or-start dring.

@PharmaceuticalCobweb commented on GitHub (Oct 2, 2017): I added join-or-start ring to my profile and they still start separately. Also tried join-or-start dring.

gitea-mirror commented

2026-05-05 07:22:44 -06:00

Author

Owner

@PharmaceuticalCobweb commented on GitHub (Oct 13, 2017):

I've also noticed that the dring back-end needs access to /dev/shm in order for any webcam functionality (if you run gnome-ring in the current firejail profile click on the cog labelled settings and click "media" with a webcam installed gnome-ring with output to terminal: "could not open shm area "Ring Daemon_shm_9710_0"" although my webcam's LED indicator does light up). Tried "noblacklist /dev/shm" in gnome-ring.profile but dring still seems incapable of accessing /dev/shm.

So I navigated to /usr/lib/ring and started the dring process manually using "firejail --noblacklist=/dev/shm ./dring" to see if allowing it to access those files fixed webcam functionality. However, when you start gnome-ring with the dring process running manually (in firejail), it will not open with no noteworthy errors. I made sure to pkill both dring and gnome-ring beforehand, it just won't start. Although, if you run dring manually without firejail it does work but webcam functionality is not restored until you run both gnome-ring and dring with --noprofile. As a last ditch attempt I ran dring manually using "firejail --noblacklist=/dev/shm --join-or-start gnome-ring ./dring" however, this also failed to restore webcam functionality.

@PharmaceuticalCobweb commented on GitHub (Oct 13, 2017): I've also noticed that the dring back-end needs access to /dev/shm in order for any webcam functionality (if you run gnome-ring in the current firejail profile click on the cog labelled settings and click "media" with a webcam installed gnome-ring with output to terminal: "could not open shm area "Ring Daemon_shm_9710_0"" although my webcam's LED indicator does light up). Tried "noblacklist /dev/shm" in gnome-ring.profile but dring still seems incapable of accessing /dev/shm. So I navigated to /usr/lib/ring and started the dring process manually using "firejail --noblacklist=/dev/shm ./dring" to see if allowing it to access those files fixed webcam functionality. However, when you start gnome-ring with the dring process running manually (in firejail), it will not open with no noteworthy errors. I made sure to pkill both dring and gnome-ring beforehand, it just won't start. Although, if you run dring manually without firejail it does work but webcam functionality is not restored until you run both gnome-ring and dring with --noprofile. As a last ditch attempt I ran dring manually using "firejail --noblacklist=/dev/shm --join-or-start gnome-ring ./dring" however, this also failed to restore webcam functionality.

gitea-mirror commented

2026-05-05 07:22:46 -06:00

Author

Owner

@smitsohu commented on GitHub (Nov 2, 2017):

Right now if you open gnome-ring in firejail (using default restrictive settings or the profile I wrote) it will start dring and gnome-ring in two different firejail sandboxes.

Could you check if there is a dring in your /usr/local/bin? And could you maybe paste here the output of firejail --tree?

Tried "noblacklist /dev/shm" in gnome-ring.profile but dring still seems incapable of accessing /dev/shm.

--noblacklist=/dev/shm will not help because we don't blacklist this folder, it is basically always available inside the sandbox. But you could try with --ignore=ipc-namespace, it is supposed to interrupt shared memory IPC.

@smitsohu commented on GitHub (Nov 2, 2017): > Right now if you open gnome-ring in firejail (using default restrictive settings or the profile I wrote) it will start dring and gnome-ring in two different firejail sandboxes. Could you check if there is a dring in your /usr/local/bin? And could you maybe paste here the output of `firejail --tree`? > Tried "noblacklist /dev/shm" in gnome-ring.profile but dring still seems incapable of accessing /dev/shm. `--noblacklist=/dev/shm` will not help because we don't blacklist this folder, it is basically always available inside the sandbox. But you could try with `--ignore=ipc-namespace`, it is supposed to interrupt shared memory IPC.

gitea-mirror commented

2026-05-05 07:22:48 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Nov 2, 2017):

@smitsohu afaik /dev/shm is always blacklisted if private-dev is enabled

@SkewedZeppelin commented on GitHub (Nov 2, 2017): @smitsohu afaik /dev/shm is always blacklisted if private-dev is enabled

gitea-mirror commented

2026-05-05 07:22:49 -06:00

Author

Owner

@smitsohu commented on GitHub (Nov 2, 2017):

@SpotComms Hmmm, it looks I understood it wrong (from reading only the documentation)... when private-dev is enabled, /dev/shm is in fact private to the sandbox, not a bind-mount as I assumed originally.

@PharmaceuticalCobweb So if disabling ipc-namespace is not sufficient, we might need to disable private-dev too or indeed run dring and gnome-ring in the same sandbox. While the question remains why there are two sandboxes in the first place.

@smitsohu commented on GitHub (Nov 2, 2017): @SpotComms Hmmm, it looks I understood it wrong (from reading only the documentation)... when private-dev is enabled, /dev/shm is in fact private to the sandbox, not a bind-mount as I assumed originally. @PharmaceuticalCobweb So if disabling `ipc-namespace` is not sufficient, we might need to disable `private-dev` too **or** indeed run dring and gnome-ring in the same sandbox. While the question remains why there are two sandboxes in the first place.

gitea-mirror commented

2026-05-05 07:22:50 -06:00

Author

Owner

@smitsohu commented on GitHub (Nov 3, 2017):

@PharmaceuticalCobweb It seems that when gnome-ring starts, it requests via dbus the activation of dring. The expected outcome would be that dring runs without firejail, and only gnome-ring is firejailed.

Normally, to run dring in firejail, it will be necessary to edit a service file, e.g. in /usr/share/dbus-1/services.

@smitsohu commented on GitHub (Nov 3, 2017): @PharmaceuticalCobweb It seems that when gnome-ring starts, it requests via dbus the activation of dring. The expected outcome would be that dring runs without firejail, and only gnome-ring is firejailed. Normally, to run dring in firejail, it will be necessary to edit a service file, e.g. in /usr/share/dbus-1/services.

gitea-mirror commented

2026-05-05 07:22:52 -06:00

Author

Owner

@smitsohu commented on GitHub (Nov 9, 2017):

I didn't test much functionality, but it seems that protocol unix,inet,inet6,netlink and commenting private-dev solve the main issue.

In order to sandbox ring daemon, create a file /etc/firejail/gnome-ring.local and put join-or-start ring inside. Then run cd /usr/share && sudo cp --parents dbus-1/services/cx.ring.Ring.service /usr/local/share and replace the Exec line in /usr/local/share/dbus-1/services/cx.ring.Ring.service with firejail --profile=/etc/firejail/gnome-ring.profile /usr/lib/ring/dring.
dring and gnome-ring should now always end up in the same sandbox (with webcam working). Thanks @SpotComms for the idea.

A possible alternative is to edit ~/.config/autostart/gnome-ring.desktop and replace the Exec line there with Exec=firejail --profile=/etc/firejail/gnome-ring.profile dbus-launch gnome-ring --restore-last-window-state. Part of the Gnome session will be duplicated inside the sandbox, which you may like or dislike.

@smitsohu commented on GitHub (Nov 9, 2017): I didn't test much functionality, but it seems that `protocol unix,inet,inet6,netlink` and commenting `private-dev` solve the main issue. In order to sandbox ring daemon, create a file /etc/firejail/gnome-ring.local and put `join-or-start ring` inside. Then run `cd /usr/share && sudo cp --parents dbus-1/services/cx.ring.Ring.service /usr/local/share` and replace the Exec line in /usr/local/share/dbus-1/services/cx.ring.Ring.service with `firejail --profile=/etc/firejail/gnome-ring.profile /usr/lib/ring/dring`. dring and gnome-ring should now always end up in the same sandbox (with webcam working). Thanks @SpotComms for the idea. A possible alternative is to edit ~/.config/autostart/gnome-ring.desktop and replace the Exec line there with `Exec=firejail --profile=/etc/firejail/gnome-ring.profile dbus-launch gnome-ring --restore-last-window-state`. Part of the Gnome session will be duplicated inside the sandbox, which you may like or dislike.

Rows
Columns

[GH-ISSUE #1586] gnome-ring can't interact with dring #1057