github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1749] Thunderbird fails to execute child process (Operation not permitted) #1186

New issue

Closed

opened 2026-05-05 07:37:28 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 07:37:28 -06:00

Owner

Originally created by @SecT0uch on GitHub (Jan 24, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1749

When I launch thunderbird I get the symbolic link warning :

Reading profile /etc/firejail/thunderbird.profile
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 2992, child pid 2993
**Warning cannot create symbolic link /var/run**
Blacklist violations are logged to syslog
Child process initialized in 57.14 ms

And then, when I try to open an URL with thunderbird I got this one :
** (thunderbird:7): WARNING **: Could not launch default application for URI: Failed to execute child process “firefox” (Operation not permitted)**

Is it a bug or is there a workaround for that ?

Originally created by @SecT0uch on GitHub (Jan 24, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1749 When I launch thunderbird I get the symbolic link warning : ```$thunderbird Reading profile /etc/firejail/thunderbird.profile Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Reading profile /etc/firejail/firefox.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 2992, child pid 2993 **Warning cannot create symbolic link /var/run** Blacklist violations are logged to syslog Child process initialized in 57.14 ms ``` And then, when I try to open an URL with thunderbird I got this one : `** (thunderbird:7): WARNING **: Could not launch default application for URI: Failed to execute child process “firefox” (Operation not permitted)**` Is it a bug or is there a workaround for that ?

gitea-mirror

2026-05-05 07:37:28 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 07:37:33 -06:00

Author

Owner

@smitsohu commented on GitHub (Jan 24, 2018):

Hi @SecT0uch What is your distro? Which firejail version do you use? Does it work with firejail --noprofile thunderbird?

@smitsohu commented on GitHub (Jan 24, 2018): Hi @SecT0uch What is your distro? Which firejail version do you use? Does it work with `firejail --noprofile thunderbird`?

gitea-mirror commented

2026-05-05 07:37:35 -06:00

Author

Owner

@SecT0uch commented on GitHub (Jan 25, 2018):

Hi, my distro is Parrot OS (based on Debian), firejail is pre-installed.

$ firejail --version
firejail version 0.9.52

I get exactly the same error with the --noprofile option.

@SecT0uch commented on GitHub (Jan 25, 2018): Hi, my distro is Parrot OS (based on Debian), firejail is pre-installed. ``` $ firejail --version firejail version 0.9.52 ``` I get exactly the same error with the `--noprofile` option.

gitea-mirror commented

2026-05-05 07:37:37 -06:00

Author

Owner

@smitsohu commented on GitHub (Jan 25, 2018):

Thanks. Could you check sudo aa-status if an apparmor profile for thunderbird is in enforce mode?

If yes, could you run sudo aa-disable usr.bin.thunderbird and try it again?

@smitsohu commented on GitHub (Jan 25, 2018): Thanks. Could you check `sudo aa-status` if an apparmor profile for thunderbird is in enforce mode? If yes, could you run `sudo aa-disable usr.bin.thunderbird` and try it again?

gitea-mirror commented

2026-05-05 07:37:38 -06:00

Author

Owner

@SecT0uch commented on GitHub (Jan 25, 2018):

Indeed, thunderbird was in enforced mode.
And yes it works perfectly disabling the AppArmor profile.
I will try to get a clean profile and let you know.

Thanks a lot !

@SecT0uch commented on GitHub (Jan 25, 2018): Indeed, thunderbird was in enforced mode. And yes it works perfectly disabling the AppArmor profile. I will try to get a clean profile and let you know. Thanks a lot !

gitea-mirror referenced this issue

2026-05-05 10:09:30 -06:00

[PR #1186] [MERGED] Add Go, Rust, and OpenSSL to disable-devel.conf #3872

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1186

No description provided.

Rows
Columns