mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #1703] Couldn't start 'libreoffice' in Debian Testing #1151
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1151
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @bitfreak25 on GitHub (Dec 30, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1703
With the current state of Debian Testing (with firejail 0.9.52) I couldn't start the program "libreoffice".
The output for "firejail libreoffice" is the following:
@SkewedZeppelin commented on GitHub (Jan 1, 2018):
Can you edit /etc/firejail/libreoffice.profile, disable all the options, and re-enable them one by one until it crashes? Thanks.
@bitfreak25 commented on GitHub (Jan 1, 2018):
It crashed until I re-enable one of the following lines:
All other could be re-enabled without problems.
The thrown errors looks like the same as above but with the exception of re-enabling line "noroot" with the following output:
PS:
I could start libreoffice with re-enabling line "noroot" but only with calling "firejail libreoffice", not with "libreoffice" alone when "firecfg" is called before.
@SkewedZeppelin commented on GitHub (Jan 1, 2018):
I'm unable to reproduce under Arch or under Debian Buster both with LibreOffice 5.4.4.2.
After running
firecfg, runningfirejail [program enabled by firecfg]is equivalent to runningfirejail --profile=/etc/firejail/[program].profile firejail [program]unless you use the full path, egfirejail /usr/bin/libreoffice.@netblue30 commented on GitHub (Jan 2, 2018):
I'll start tracking Debian testing here, let's mark it as a bug for now.
This looks like some SUID executable in java package or in the graphic card stack. @bitfreak25 what graphic card drivers are you using?
@bitfreak25 commented on GitHub (Jan 2, 2018):
I'm using the non-free nvidia-driver from Debian: nvidia-legacy-340xx-driver
I also found the following private commit from ParrotSec which could be related to this bug:
ee2c6777a3@chiraag-nataraj commented on GitHub (Jan 7, 2018):
@bitfreak25 Which version of libreoffice are you running?
@bitfreak25 commented on GitHub (Jan 7, 2018):
@chiraag-nataraj As the title says: 'libreoffice' in Debian Testing. This is currently version 5.4.4 .
@chiraag-nataraj commented on GitHub (Jan 7, 2018):
Shit, I should learn to read more carefully 😜 The exact same version is in sid. Can you try this profile?
libreoffice.txt
@Fred-Barclay commented on GitHub (Jan 7, 2018):
I can see in in Debian Testing, firejail 0.9.52 from the Debian repos, and LibreOffice 5.4.4.2 as well. I did not run
firecfgpreviously and the system is using Virtual Box's guest additions drivers.Just like @bitfreak25 noted in https://github.com/netblue30/firejail/issues/1703#issuecomment-354651436, the important lines seem to be
With either
nonewprivs,protocol unix,inet,inet6, orseccompuncommented,With
norootuncommented,@bitfreak25 commented on GitHub (Jan 7, 2018):
@chiraag-nataraj I tested your libreoffice.txt file by using its content in /etc/firejail/libreoffice.profile. But it gives the same error message.
@chiraag-nataraj commented on GitHub (Jan 8, 2018):
Hmm, that's weird. I have the exact same versions of both libreoffice and firejail, yet the profile I attached works for me. So this means the protocol problem is just an incidental thing (I use
net nonein my profile, so I don't bother filtering the protocols).What happens if you use
--traceor--debug? Does it give any more information?@chrsmrtnx commented on GitHub (Jan 21, 2018):
I have a likely related issue on Debian testing.
If I run "firejail libreoffice example.ods" (or try to load any other document) I get a little pop-up telling me "Write Error. The file could not be written." and then libreoffice exits. To be clear, I can run "firejail libreoffice" and it starts normally. But it fails with "Write Error. The file could not be written." when I then select a document to open.
I can work-around the problem by commenting out "private-tmp" from libreoffice.profile .
@ghost commented on GitHub (Mar 26, 2018):
Same problem here, need to disable the following
nonewprivs
noroot
protocol unix,inet,inet6
seccomp
Any news on when this is getting fixed?
@netblue30 commented on GitHub (Mar 27, 2018):
Still fighting with it. I put a fix in to allow Java, it was crashing it on some distros. Go in /etc/firejail/libreoffice.profile and comment out (add a #) this line:
Try to see if this works. Also some questions:
Does it work if you start lowriter directly (type "lowriter" in a terminal)?
What video card are you using and what video drivers?
@ghost commented on GitHub (Mar 27, 2018):
Hmm, actually it doesn't work. I made a mistake and didn't start LibreOffice with firejail.
Commenting that line doesn't work for me.
@ghost commented on GitHub (Apr 7, 2018):
I have the same issue here on Kubuntu 17.10 with libreoffice 6.0.2.1 from the ppa (firejail version 0.9.50).
I tried amarildojr's temp' fix and it works, although I do not need to disable noroot for it to work. Only disabling nonewprivs, protocol unix,inet,inet6 and seccomp makes it work for me. Commenting out disable-devel.inc does not fix it.
@smitsohu commented on GitHub (Apr 7, 2018):
Could also be symptoms of an AppArmor policy with profile transition. Can someone please try if
firejail --apparmor libreofficehelps? Or, alternatively, runsudo aa-disable <profilename>, in case there are enforced libreoffice profiles. I'm on a different system in the moment and can't try myself.@ghost commented on GitHub (Apr 7, 2018):
I reverted libreoffice.profile to original state and tested :
Adding
export $(dbus-launch)to .bashrc does not change the message nor allows LO to start.@smitsohu commented on GitHub (Apr 8, 2018):
@amartos Thanks. While it doesn't provide insight regarding the original issue, this is interesting because we were planning to enable
apparmorand the newnodbusoption by default for LibreOffice. I guess we might need to reconsider it :)Would you please try it with temporarily disabling apparmor for libreoffice? Or else, could someone on Debian testing give it a try?
@ghost commented on GitHub (Apr 8, 2018):
(Not a power user here, so playing with apparmor is something I barely understand, sorry)
Does nothing. :/ There were multiple profiles for libreoffice, but
aa-disable libreofficewouldn't work, so I did it only for the executable. Hope it helps anyway.@Panzerfather commented on GitHub (Apr 16, 2018):
We ran into the same problem on Fedora-Systems where apparmor isn't even installed. So we tried some different options and after only commenting this line libreoffice successfully starts like in V0.9.50.
So it seems that libreoffice needs at least one more directory to be whitelisted to function correctly.
@HotelBellaMuerte commented on GitHub (Apr 17, 2018):
@smitsohu @Panzerfather
it happens here too (manjaro KDE, linux416)
@Panzerfather commented on GitHub (Apr 19, 2018):
@bn0785ac
Pull https://github.com/netblue30/firejail/pull/1894 doesn't fix the problem on Fedora 27 for us. Tested on various PCs. Only commenting the whitelist-var-common include let's start libreoffice.
So that it looks like this:
All other fixes aren't needed for Fedora 27 to run libreoffice successfully. It seems like libreoffice is missing a whitelist path for javaldx.
@smitsohu commented on GitHub (Apr 20, 2018):
@bn0785ac Does the solution of @Panzerfather work for you?
@Panzerfather commented on GitHub (May 6, 2018):
After updating to the latest profile, the problem still exists on Fedora 27+28 for us. So we did some more tracing to get this problem fixed.
All we have to comment in the profile to let libreoffice run just like in 0.9.50 are the following lines:
-> fixes the "javaldx failed!" error, because it doesn't blacklist the other directories:
#include /etc/firejail/whitelist-var-common.inc-> fixes the menu bar which isn't shown when active:
#nodbusAll other options which have to be commented for Ubuntu/Debian can be uncommented and libreoffice works in Fedora.
So we run firejail with debug and trace to get a deeper look at where it's failing and we found the following error:
The file exists, but firejail seems to lock the access for libreoffice. We tried some solutions to noblacklist|whitelist the path, but either firejail ignores it (noblacklist) or returns an invalid whitelist path error (whitelist). Also solutions like read-only doesn't seem to work.
So we took a quick review of the source code and it seems that firejail is rejecting whitelisting paths like /usr/lib{,32,64}.
Is there a special command to let the program have access to these paths?
@smitsohu commented on GitHub (May 7, 2018):
@panzerfather In case you have strace installed, could you try something like
strace -y /usr/bin/libreoffice 2>&1 | grep /var? The question is then if this yields paths that are not covered in /etc/firejail/whitelist-var-common.inc. You can also attach the output here if you want.(command edited)
@Panzerfather commented on GitHub (May 7, 2018):
@smitsohu Thanks for the hint, which pointed us in the right direction for a fix in Fedora 27/28. Currently undergoing tests and soon be available as a pull request. 😄
@chiraag-nataraj commented on GitHub (Jul 22, 2018):
Is this fixed now?
@chiraag-nataraj commented on GitHub (Jul 24, 2018):
Closing for now. Please feel free to re-open if the issue is not fixed.