[GH-ISSUE #1855] transmission-gtk freezes on opening GTK dialogs (mprotect syscall gets blocked) #1255

New issue

Closed

opened 2026-05-05 07:44:18 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 07:44:18 -06:00

Owner

Originally created by @ratm-github on GitHub (Apr 2, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1855

I am not reopening #1736 as that explicitly mentions QT, whereas this issue is about transmission-gtk. However, the observed symptoms are the same.

The observed behavior is a freeze as soon as Transmission needs to open any new dialog (Open file - Open URL - ...). As in #1736, removing memory-deny-write-execute makes everything work. I confirmed using strace that the binary is making a call that the seccomp filter duly blocks:

$ /bin/strace -o transmission.strace -f -e mprotect /usr/bin/transmission-gtk
$ # Click on "Open file" to have the dialog pop up, then close

$ grep "PROT_READ|PROT_WRITE|PROT_EXEC" transmission.strace 
31545 mprotect(0x7ffcd18bb000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_GROWSDOWN) = 0
31545 mprotect(0x7f8f30dbb000, 8388608, PROT_READ|PROT_WRITE|PROT_EXEC) = 0
[snip more lines like the one above]

I was quite puzzled by the need for RWX memory mappings as I couldn't find any reference to mmap/mprotect directly in the transmission source code. Therefore, I ran transmission-gtk under gdb to get the call trace when mprotect() is called with 0x7 (PROT_READ | PROT_WRITE | PROT_EXEC). It turns out that it is a result of calling dlopen in gtk_widget_show.

Here's a snippet of the backtrace as seen by gdb. Full backtrace is attached:

#0  0x00007ffff4eacb70 in mprotect () at /usr/lib/libc.so.6
#1  0x00007ffff5178d5a in change_stack_perm () at /usr/lib/libpthread.so.0
#2  0x00007ffff5179534 in __make_stacks_executable () at /usr/lib/libpthread.so.0
#14 0x00007fffefbc9f22 in dlopen () at /usr/lib/libdl.so.2
#15 0x00007ffff4bb951e in g_module_open () at /usr/lib/libgmodule-2.0.so.0
#18 0x00007ffff6b73781 in gdk_pixbuf_loader_write () at /usr/lib/libgdk_pixbuf-2.0.so.0
#19 0x00007ffff766af8c in  () at /usr/lib/libgtk-3.so.0
#42 0x00007ffff656cc2d in g_closure_invoke () at /usr/lib/libgobject-2.0.so.0
#46 0x00007ffff764b93b in gtk_widget_show () at /usr/lib/libgtk-3.so.0

Based on the above, I think the default profile for transmission-gtk should remove memory-deny-write-execute as was done in #1736 for transmission-qt.

For reference, here's my environment. I'll note that both myself and the original reporter of #1736 are on Arch, so it is possible that the dlopen() codepath gets triggered only on Arch due to some packaging issue. I haven't had time to debug/reproduce this on another distro.

$ cat /etc/lsb-release 
LSB_VERSION=1.4
DISTRIB_ID=Arch
DISTRIB_RELEASE=rolling
DISTRIB_DESCRIPTION="Arch Linux"

$ /usr/bin/transmission-gtk -v
transmission-gtk 2.93 (3c5870d4f5)

$ # Versions for libgtk-3 and libgdk_pixbuf used by Transmission
$ ldd /usr/bin/transmission-gtk | grep -E 'gtk-3|pixbuf'
	libgtk-3.so.0 => /usr/lib/libgtk-3.so.0 (0x00007fb3097fe000)
	libgdk_pixbuf-2.0.so.0 => /usr/lib/libgdk_pixbuf-2.0.so.0 (0x00007fb30909e000)

$ pacman -Qo /usr/lib/libgtk-3.so /usr/lib/libgdk_pixbuf-2.0.so.0
/usr/lib/libgtk-3.so is owned by gtk3 3.22.29+60+ge42d8598ca-1
/usr/lib/libgdk_pixbuf-2.0.so.0 is owned by gdk-pixbuf2 2.36.11+70+g00e03a272-1

Originally created by @ratm-github on GitHub (Apr 2, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1855 I am not reopening #1736 as that explicitly mentions QT, whereas this issue is about transmission-gtk. However, the observed symptoms are the same. The observed behavior is a freeze as soon as Transmission needs to open any new dialog (Open file - Open URL - ...). As in #1736, removing `memory-deny-write-execute` makes everything work. I confirmed using strace that the binary is making a call that the seccomp filter duly blocks: ```shell $ /bin/strace -o transmission.strace -f -e mprotect /usr/bin/transmission-gtk $ # Click on "Open file" to have the dialog pop up, then close $ grep "PROT_READ|PROT_WRITE|PROT_EXEC" transmission.strace 31545 mprotect(0x7ffcd18bb000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_GROWSDOWN) = 0 31545 mprotect(0x7f8f30dbb000, 8388608, PROT_READ|PROT_WRITE|PROT_EXEC) = 0 [snip more lines like the one above] ``` I was quite puzzled by the need for RWX memory mappings as I couldn't find any reference to mmap/mprotect directly in the transmission source code. Therefore, I ran transmission-gtk under gdb to get the call trace when mprotect() is called with 0x7 (PROT_READ | PROT_WRITE | PROT_EXEC). It turns out that it is a result of calling `dlopen` in `gtk_widget_show`. Here's a snippet of the backtrace as seen by gdb. Full backtrace is [attached](https://github.com/netblue30/firejail/files/1867960/transmission.stacktrace.txt): ``` #0 0x00007ffff4eacb70 in mprotect () at /usr/lib/libc.so.6 #1 0x00007ffff5178d5a in change_stack_perm () at /usr/lib/libpthread.so.0 #2 0x00007ffff5179534 in __make_stacks_executable () at /usr/lib/libpthread.so.0 #14 0x00007fffefbc9f22 in dlopen () at /usr/lib/libdl.so.2 #15 0x00007ffff4bb951e in g_module_open () at /usr/lib/libgmodule-2.0.so.0 #18 0x00007ffff6b73781 in gdk_pixbuf_loader_write () at /usr/lib/libgdk_pixbuf-2.0.so.0 #19 0x00007ffff766af8c in () at /usr/lib/libgtk-3.so.0 #42 0x00007ffff656cc2d in g_closure_invoke () at /usr/lib/libgobject-2.0.so.0 #46 0x00007ffff764b93b in gtk_widget_show () at /usr/lib/libgtk-3.so.0 ``` Based on the above, I think the default profile for transmission-gtk should remove `memory-deny-write-execute` as was done in #1736 for transmission-qt. For reference, here's my environment. I'll note that both myself and the original reporter of #1736 are on Arch, so it is possible that the `dlopen()` codepath gets triggered only on Arch due to some packaging issue. I haven't had time to debug/reproduce this on another distro. ```shell $ cat /etc/lsb-release LSB_VERSION=1.4 DISTRIB_ID=Arch DISTRIB_RELEASE=rolling DISTRIB_DESCRIPTION="Arch Linux" $ /usr/bin/transmission-gtk -v transmission-gtk 2.93 (3c5870d4f5) $ # Versions for libgtk-3 and libgdk_pixbuf used by Transmission $ ldd /usr/bin/transmission-gtk | grep -E 'gtk-3|pixbuf' libgtk-3.so.0 => /usr/lib/libgtk-3.so.0 (0x00007fb3097fe000) libgdk_pixbuf-2.0.so.0 => /usr/lib/libgdk_pixbuf-2.0.so.0 (0x00007fb30909e000) $ pacman -Qo /usr/lib/libgtk-3.so /usr/lib/libgdk_pixbuf-2.0.so.0 /usr/lib/libgtk-3.so is owned by gtk3 3.22.29+60+ge42d8598ca-1 /usr/lib/libgdk_pixbuf-2.0.so.0 is owned by gdk-pixbuf2 2.36.11+70+g00e03a272-1 ```

gitea-mirror closed this issue

2026-05-05 07:44:19 -06:00

gitea-mirror commented

2026-05-05 07:44:23 -06:00

Author

Owner

@Vincent43 commented on GitHub (Apr 2, 2018):

Thanks for this detailed report. Fixed with 8cc0110502

@Vincent43 commented on GitHub (Apr 2, 2018): Thanks for this detailed report. Fixed with https://github.com/netblue30/firejail/commit/8cc01105028eae5416c085b7a1bd031263f6d55a

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1255

No description provided.

Rows
Columns