mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #1740] skypeforlinux hangs with white non-responsive window, firejail 0.9.52 #1177
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1177
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @selivan on GitHub (Jan 19, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1740
firejail: 0.9.52 (from Ubuntu ppa: deki/firejail)
skypeforlinux: 8.13.0.2
Skype window show loading process for a short time, then it becomes white non-responsive window. Without firejail it works fine.
Screenshot:
It is Electron-based, so I tried using chromium profile with additional whitelist for
${HOME}/.config/skypeforlinux, but it hangs the same way.Is there any way I can debug this, like print what did it stumble upon?
--debugdidn't help much, neither did--allow-debugges strace ...@selivan commented on GitHub (Jan 19, 2018):
I poke it with a stick and found, that without
private-devit works.--allow-debuggers strace ...shows, that is uses/dev/aload*:Is there any way to allow this
/dev/aload*files forprivate-dev?Also, you should probably disable
private-devin skypeforlinux profile for now.@chiraag-nataraj commented on GitHub (Jan 19, 2018):
Hmm...I don't even have
/dev/aload*on my system...are those files created by Skype?@selivan commented on GitHub (Jan 19, 2018):
@chiraag-nataraj Hmm, I was wrong, my system doesn't have
/dev/aload*files either. Something about ALSA, I suppose. Here are all files it uses from/dev: https://gist.github.com/selivan/926479e48c799cb4b7a37eb741af6c12Everything seems allowed according to firejail manpage:
Anyway, it works without
private-devand doesn't work with it, I just can't find out why. Any ideas?@chiraag-nataraj commented on GitHub (Jan 19, 2018):
I'm going to download it and try it out and report back 🙂
@chiraag-nataraj commented on GitHub (Jan 19, 2018):
Hmm...I'm using the default profile for
skypeforlinuxwithprivate-devuncommented and it just worked for me. Although...I'm not logged in. Let me log in to see what happens.@selivan commented on GitHub (Jan 19, 2018):
@chiraag-nataraj Yep, when I was playing with chrome profile and forgot to allow
$HOME/.config/skypeforlinux, it showed me login window. Try to log in.@Fred-Barclay commented on GitHub (Jan 22, 2018):
See also #1730
@selivan commented on GitHub (Jan 22, 2018):
@Fred-Barclay Tried it with both of
/run/systemdand/var/run/systemd, didn't help. Only removingnodevhelps.Btw, I noticed that this whte non-responsive window loads 100% of one of processor cores.
@smitsohu commented on GitHub (Jan 23, 2018):
Hi @selivan, if you want you can try pasting the following into /etc/firejail/skypeforlinux.local
Adjust this for your system according to the output of
firejail --quiet --private-dev --nodvd --notv ls -1 /devIf that works, the culprit should be /dev/shm.
@selivan commented on GitHub (Jan 23, 2018):
@smitsohu
firejail --quiet --private-dev --nodvd --notv ls -1 /dev:~/.config/firejail/skypeforlinux.profile: https://gist.github.com/selivan/cd5742035409fe0571e1507046c71506firejail --profile=~/.config/firejail/skypeforlinux.profile /usr/bin/skypeforlinuxstill end up with white non-responsive window after short time(login, I suppose). Moreover, if I comment out
ignore private-dev, and leave justwhitelist *, it still hangs, even withoutprivate-devin config O_o@smitsohu commented on GitHub (Jan 23, 2018):
whitelist /dev/disk(in addition to the other whitelisting in /dev) works as a workaround for me.EDIT: I just see now that you mentioned /dev/disk/by-id already in an earlier post. This folder is not whitelisted by
private-dev, which is why the app breaks.@selivan commented on GitHub (Jan 23, 2018):
@smitsohu nope, this still doesn't work:
Btw, man firejail says:
"disc, dri, null, full, zero, tty, pts, ptmx, random, snd, urandom, video, log and shm devices are available.",
so disc should be available with private-dev.
@smitsohu commented on GitHub (Jan 23, 2018):
private-devand whitelisting in /dev are mutually exclusive. Try it again withoutprivate-devplease.Also I think there was a misunderstanding regarding disc. It is an alias for /dev/sr0, /dev/dvd and so on, i.e. for cd and dvd devices.
@selivan commented on GitHub (Jan 23, 2018):
@smitsohu without
private-devit works even without any whitelisting. And with whitelisting too, of course. But is sees real /dev, which is no good.@selivan commented on GitHub (Jan 23, 2018):
@smitsohu it would be much better to have some
private-dev-extended, including whatever it needs there.@smitsohu commented on GitHub (Jan 23, 2018):
@selivan
Yes, but with whitelisting only a fraction of /dev is available inside the jail.
We've had this discussion before, check out #1446. I wonder though how widespread issues with /dev/disk are. It would be interesting to see if more electron apps are affected.
@netblue30 what do you think?
@bmeh commented on GitHub (Jan 28, 2018):
I would like to note that Electron apps (too) (Wire, for example, amongst many others) have not been working for me for a few months now. I am getting
error while loading shared libraries: libnode.so: cannot open shared object file: No such file or directory, which could be a problem caused by not having the directory containing the executable andlibnode.sowhitelisted, except it is. At least with a previous version I could justcdto the directory that containslibnode.soand it would work, but it doesn't work anymore that way either. Additionally, even in this case, the application wouldn't always show up properly (meaning it freezes, not getting displayed as expected), it would just start giving me such errors:And on occasions, it would work as expected (???), but it's pretty rare.
Aaaaand
steam-nativeis broken as well. It has been for a while.Note: all the applications not working with firejail do work without it.
I don't know what changed, but it seems like firejail has been broken for a few months now. I tried downgrading to an older version, but it doesn't work either. Any pointers to a workaround or something? Mind you,
firejail --noprofile foobarworks, but yeah.Distro: Arch Linux
firejail --quiet --private-dev --nodvd --notv ls -1 /dev:Update:
This is very odd, commenting
norootin/etc/firejail/steam.profile(andwire.profile) solves all the issues, and the window is responsive and is displayed correctly. Huh?@selivan commented on GitHub (Jan 28, 2018):
@bmeh you may want to create a new issue for that, this one is about broken skypeforlinux.
@chiraag-nataraj commented on GitHub (Sep 28, 2018):
@selivan Is this still an issue?
@selivan commented on GitHub (Oct 9, 2018):
@chiraag-nataraj Nope, with firejail
0.9.56and skypeforlinux8.31.0.92I don't have this problem.@Vincent43 commented on GitHub (Oct 9, 2018):
Thx for the report.