mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #1651] Dropbox failed to start after update the firejail new built yesterday #1113
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1113
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @cryptogun on GitHub (Nov 17, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1651
After the prompt printed
posixffi.libc._posixffi_libc.sothis pop up:And then pop up:
ls /tmp/drop*gets none.Traceback:
@Fred-Barclay commented on GitHub (Nov 17, 2017):
Thanks for the report! It should be fixed now.
@cryptogun commented on GitHub (Nov 18, 2017):
Thanks for the fix.
Feed back: Not perfect after adding that line (
noblacklist ~/.dropbox).I can open dropbox and open the preference tabs. But:
https://www.dropbox.com/cli_link_nonce?nonce=***in Chrome and sign in. (I deleted.dropboxand.dropbox-distbefore).dropbox startis not daemonized now. Ctrl + C` quits Dropbox. Previous I can type that command and quit the prompt without closing Dropbox./usr/bin/dropboxrun without any problem.@Fred-Barclay commented on GitHub (Nov 18, 2017):
To run Chrome, you'll need to copy the dropbox.profile to ~/.config/firejail, and then comment out (add a
#to the beginning) of at least these lines:This is because Chrome is started inside the Dropbox sandbox. Chrome has its own sandbox that doesn't interface well with firejail, so you'll need to loosen dropbox's profile so that Chrome can run in it.
If you only do this, Chrome won't be able to see its settings or bookmarks. For it to run normally, you'll also need to add the lines
to the other noblacklist lines in dropbox.profile, and
to the other whitelist lines.
About the second problem, there's no way around this that I'm aware of. The daemon is running inside firejail, so Ctrl+C kills firejail and therefore dropboxd.
Cheers!
Fred
@cryptogun commented on GitHub (Nov 18, 2017):
OK. I use
/usr/bin/dropbox startso as to link to my account. Then I can usefirejail dropbox startnow.Oh I remembered that I first installed firejail then Dropbox, so there's no sim-link
/usr/local/bin/dropbox -> /usr/local/bin/firejailso I can daemonize it previously.
Not big deal because I can start Dropbox from startup menu, without a prompt.
Thank you all :)
@Tanath commented on GitHub (Jan 22, 2018):
I was getting this issue until I commented out
noroot.@Fred-Barclay commented on GitHub (Jan 22, 2018):
Thanks @Tanath. I think it's better for now to keep
norootin the main profile and just start dropbox outside firejail whenever you need to update, rather than to run it withoutnorootall the time (which could theoretically allow a sucessful attacker, or a bug in the program, to act with root permissions.)Although we do have the
nonewprivsline, so removingnorootmight be okay. @SpotComms any thoughts?@SkewedZeppelin commented on GitHub (Jan 22, 2018):
@Fred-Barclay We can just comment it for now, I don't think its too big an issue. I just wonder why
norootwould cause it not to start.@Fred-Barclay commented on GitHub (Jan 22, 2018):
I think the first three lines in the OP hinted at noroot being a problem. But then, nonewprivs would probably have blocked running a shell as root too. 😕
@Tanath commented on GitHub (Jan 22, 2018):
I don't know if this is related but may be worth mentioning. My Dropbox has been unable to update in-app for a very long time. When I run it in firejail it takes an hour or so but then it does the same thing as running without. It perpetually says 'Upgrading Dropbox...' in the tooltip, with the spinning icon in tray.
Every time I thought I fixed it, it started again in an hour or so.
@atrent commented on GitHub (Jul 15, 2018):
Hi, I had to comment the 'include /etc/firejail/disable-interpreters.inc' in the dropbox.profile since I was getting this error:
/bin/bash: /usr/bin/dropbox: /usr/bin/python: bad interpreter: Permission denied
Then it worked.
@chiraag-nataraj commented on GitHub (Jul 15, 2018):
You should be able to use either
or
in the dropbox profile to get it to work. Can you report back on which one works so that we can add it to the profile?
@Nutjob commented on GitHub (Jul 15, 2018):
Had the same problem as @atrent since yesterday, commenting out the line worked, while trying adding the lines (tried both) as @chiraag-nataraj suggested didn't....
@chiraag-nataraj commented on GitHub (Jul 15, 2018):
Cool. @Nutjob @atrent I'll look into it and report back.
@chiraag-nataraj commented on GitHub (Jul 15, 2018):
Can you try these files? Move them to
${HOME}/.config/firejail/common.incand${HOME}/.config/firejail/dropbox.profileand give it a whirl (I've only tested syncing files, since I don't really use Dropbox all that much) 🙂 I'll probably tighten the profile further, but I wanted to see if this profile works for y'all before adding more things that may break it.common.txt
dropbox.txt
@Nutjob commented on GitHub (Jul 15, 2018):
Nope, not working.
(BTW Didn't have
common.incfile, had to make it, )EDIT: Just checked, i've got
whitelist-common.incandwhitelist-var-common.incif that can help.@chiraag-nataraj commented on GitHub (Jul 15, 2018):
I uploaded two files above!
common.txt=>common.incanddropbox.txt=>dropbox.profile:)@chiraag-nataraj commented on GitHub (Jul 15, 2018):
And if that's still not working, is it the same error or a different one?
@Nutjob commented on GitHub (Jul 15, 2018):
Now it won't start, with the message
Error: cannot access profile file@chiraag-nataraj commented on GitHub (Jul 15, 2018):
Did you copy
common.txtto~/.config/firejail/common.inc? That's the only file that this dropbox profile depends on.@chiraag-nataraj commented on GitHub (Jul 15, 2018):
Okay, you know what, never mind. I also realized there a couple of things in the
common.incfile which will break on earlier versions offirejail. If you comment out theinclude ${HOME}/.config/firejail/common.incin the dropbox profile, what happens?@Nutjob commented on GitHub (Jul 15, 2018):
Yeah, my bad about
common.inc, i put it there and gotError: line 24 in /home/user/.config/firejail/common.inc is invalid.Tried commenting the line in dropbox.profile, got the following message:
execvp: No such file or directory@chiraag-nataraj commented on GitHub (Jul 15, 2018):
Ah okay. That's because you don't have
shell none. Just comment outnou2fincommon.inc(and uncomment theincludeindropbox.profile) and try again.@Nutjob commented on GitHub (Jul 15, 2018):
Here's the result:
Parent pid 4460, child pid 4461 Warning: skipping emp for private /opt Private /opt installed in 0.12 ms 9 programs installed in 19.80 ms Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Child process initialized in 52.63 ms Starting Dropbox...Traceback (most recent call last): File "/usr/bin/dropbox", line 1535, in <module> ret = main(sys.argv) File "/usr/bin/dropbox", line 1524, in main result = commands[argv[i]](argv[i+1:]) File "/usr/bin/dropbox", line 1395, in start if not start_dropbox(): File "/usr/bin/dropbox", line 732, in start_dropbox stderr=sys.stderr, stdout=f, close_fds=True) File "/usr/lib/python2.7/subprocess.py", line 394, in __init__ errread, errwrite) File "/usr/lib/python2.7/subprocess.py", line 1047, in _execute_child raise child_exception OSError: [Errno 13] Permission denied@chiraag-nataraj commented on GitHub (Jul 15, 2018):
Which shell do you use? This is a problem with not whitelisting the proper shell I think...alternatively, you could comment out
private-binto see if that helps.@Nutjob commented on GitHub (Jul 15, 2018):
I'm using bash, i've tried to comment out
private-bin, but i'm getting an error (the line is written like this:private-bin dropbox,python,python2,sh,readlink,dirname)@chiraag-nataraj commented on GitHub (Jul 15, 2018):
What's the error you get if you comment out
private-bin?@Nutjob commented on GitHub (Jul 15, 2018):
@chiraag-nataraj commented on GitHub (Jul 15, 2018):
That's not an error. That's actually expected (it's just a warning from
firejailthat you can ignore). But does dropbox actually start?@Nutjob commented on GitHub (Jul 15, 2018):
It seems dropbox start and close immediately.
@chiraag-nataraj commented on GitHub (Jul 15, 2018):
Okay. I'm not quite sure what's going on there. There's no output at all from
dropbox?@Nutjob commented on GitHub (Jul 16, 2018):
The only output outside of the one i posted before
is:
@chiraag-nataraj commented on GitHub (Jul 16, 2018):
Hmm, that's weird. I get a bunch of output about it loading libraries and stuff. Can you try a
killall dropboxbefore running it withinfirejail?@Nutjob commented on GitHub (Jul 16, 2018):
If i try to run it within firejail i get the output i posted before.....
@chiraag-nataraj commented on GitHub (Jul 16, 2018):
sudo killall dropbox?@Nutjob commented on GitHub (Jul 16, 2018):
Same:
dropbox: no process found@chiraag-nataraj commented on GitHub (Jul 16, 2018):
Hmm, I have no idea then. I thought maybe
dropboxwas already running (and so the newdropboxquit automatically).@Nutjob commented on GitHub (Jul 18, 2018):
No, i've checked,
dropboxwasn't running ..........@chiraag-nataraj commented on GitHub (Jul 21, 2018):
If you comment out all of the dropbox-specific stuff (so the
dropbox.profilefile should just haveinclude ~/.config/firejail/common.inc), does dropbox work?@Fred-Barclay commented on GitHub (Jul 22, 2018):
Let's reopen for now!
@Nutjob commented on GitHub (Jul 22, 2018):
Yes, with that configuration dropbox starts, but it
can't connect to the dropbox server@chiraag-nataraj commented on GitHub (Jul 22, 2018):
My bad, keep the
ignorestatements as well. So just keep theignorestatements and theincludestatement.@Nutjob commented on GitHub (Jul 22, 2018):
Ok, leaving uncommented
include ~/.config/firejail/common.incandignore netseems to work, but the software stops working after installing.@chiraag-nataraj commented on GitHub (Jul 22, 2018):
Okay, so I installed
dropboxwithout sandboxing and only sandbox the running of the daemon. I don't know if/how sandboxing during installation works. I installed the daemon, linked it with my account, and then ran it sandboxed.@chiraag-nataraj commented on GitHub (May 21, 2019):
Is this still an issue?
@chiraag-nataraj commented on GitHub (May 21, 2019):
I still maintain that the easiest is to install it without sandboxing and to sandbox it after setup (this also solves the thorny issue of authenticating with the browser...). I followed the following steps and everything works pretty well:
cd ~ && wget -O - "https://www.dropbox.com/download?plat=lnx.x86_64" | tar xzf -(as recommended by the Dropbox website for headless install). This creates the~/.dropbox-distfolder, which I move to~/.local/share/dropbox.~/.local/binin my$PATH, I docd ~/.local/bin && ln -s ../share/dropbox/dropboxd .so I can easily rundropboxd.dropboxdwithout sandboxing and authenticate.~/.cache/dropboxinstead of polluting my home folder.~/.dropbox(created by the program) to~/.config/dropboxand runln -s .config/dropbox .dropbox.Now, I can start
dropboxdusingfirejail dropboxdwith the following profile files:~/.config/firejail/dropboxd.profile:~/.config/firejail/common.inc:This works successfully with Debian sid/experimental and firejail from git master.
@chiraag-nataraj commented on GitHub (May 23, 2019):
I'm going to go ahead and close this for now. @cryptogun or others, please feel free to re-open if you still have this issue or have further questions.