[GH-ISSUE #1917] LibreOffice won't start on Ubuntu 18.04

gitea-mirror commented

2026-05-05 07:47:18 -06:00

Owner

Originally created by @derba on GitHub (Apr 29, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1917

$ libreoffice
Reading profile /etc/firejail/libreoffice.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 21258, child pid 21259
Blacklist violations are logged to syslog
Child process initialized in 77.09 ms
Warning: failed to launch javaldx - java may not function correctly
ERROR 4 forking process

Parent is shutting down, bye...

$ journalctl | tail
ápr 29 19:33:20 Lapi audit[20977]: AVC apparmor="ALLOWED" operation="open" profile="libreoffice-oopslash" name="/run/firejail/mnt/fslogger" pid=20977 comm="oosplash" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
ápr 29 19:33:20 Lapi kernel: audit: type=1400 audit(1525023200.547:90): apparmor="ALLOWED" operation="open" profile="libreoffice-oopslash" name="/run/firejail/mnt/fslogger" pid=20977 comm="oosplash" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
ápr 29 19:33:20 Lapi audit[20991]: AVC apparmor="ALLOWED" operation="exec" info="no new privs" error=-1 profile="libreoffice-oopslash" name="/usr/lib/libreoffice/program/javaldx" pid=20991 comm="osl_executeProc" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 target="unconfined"
ápr 29 19:33:20 Lapi audit[20993]: AVC apparmor="ALLOWED" operation="exec" info="no new privs" error=-1 profile="libreoffice-oopslash" name="/usr/lib/libreoffice/program/soffice.bin" pid=20993 comm="osl_executeProc" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 target="libreoffice-soffice"
ápr 29 19:33:20 Lapi kernel: audit: type=1400 audit(1525023200.563:91): apparmor="ALLOWED" operation="exec" info="no new privs" error=-1 profile="libreoffice-oopslash" name="/usr/lib/libreoffice/program/javaldx" pid=20991 comm="osl_executeProc" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 target="unconfined"
ápr 29 19:33:20 Lapi kernel: audit: type=1400 audit(1525023200.563:92): apparmor="ALLOWED" operation="exec" info="no new privs" error=-1 profile="libreoffice-oopslash" name="/usr/lib/libreoffice/program/soffice.bin" pid=20993 comm="osl_executeProc" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 target="libreoffice-soffice"

$ /usr/bin/libreoffice --version
LibreOffice 6.0.3.2 00m0(Build:2)

$ firejail --version
firejail version 0.9.52

Compile time support:
- AppArmor support is enabled
- AppImage support is enabled
- bind support is enabled
- chroot support is enabled
- file and directory whitelisting support is enabled
- file transfer support is enabled
- git install support is disabled
- networking support is enabled
- overlayfs support is enabled
- private-home support is enabled
- seccomp-bpf support is enabled
- user namespace support is enabled
- X11 sandboxing support is enabled

Could you help me resolving the issue?

Originally created by @derba on GitHub (Apr 29, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1917 $ libreoffice Reading profile /etc/firejail/libreoffice.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 21258, child pid 21259 Blacklist violations are logged to syslog Child process initialized in 77.09 ms Warning: failed to launch javaldx - java may not function correctly ERROR 4 forking process Parent is shutting down, bye... $ journalctl | tail ápr 29 19:33:20 Lapi audit[20977]: AVC apparmor="ALLOWED" operation="open" profile="libreoffice-oopslash" name="/run/firejail/mnt/fslogger" pid=20977 comm="oosplash" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 ápr 29 19:33:20 Lapi kernel: audit: type=1400 audit(1525023200.547:90): apparmor="ALLOWED" operation="open" profile="libreoffice-oopslash" name="/run/firejail/mnt/fslogger" pid=20977 comm="oosplash" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 ápr 29 19:33:20 Lapi audit[20991]: AVC apparmor="ALLOWED" operation="exec" info="no new privs" error=-1 profile="libreoffice-oopslash" name="/usr/lib/libreoffice/program/javaldx" pid=20991 comm="osl_executeProc" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 target="unconfined" ápr 29 19:33:20 Lapi audit[20993]: AVC apparmor="ALLOWED" operation="exec" info="no new privs" error=-1 profile="libreoffice-oopslash" name="/usr/lib/libreoffice/program/soffice.bin" pid=20993 comm="osl_executeProc" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 target="libreoffice-soffice" ápr 29 19:33:20 Lapi kernel: audit: type=1400 audit(1525023200.563:91): apparmor="ALLOWED" operation="exec" info="no new privs" error=-1 profile="libreoffice-oopslash" name="/usr/lib/libreoffice/program/javaldx" pid=20991 comm="osl_executeProc" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 target="unconfined" ápr 29 19:33:20 Lapi kernel: audit: type=1400 audit(1525023200.563:92): apparmor="ALLOWED" operation="exec" info="no new privs" error=-1 profile="libreoffice-oopslash" name="/usr/lib/libreoffice/program/soffice.bin" pid=20993 comm="osl_executeProc" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 target="libreoffice-soffice" $ /usr/bin/libreoffice --version LibreOffice 6.0.3.2 00m0(Build:2) $ firejail --version firejail version 0.9.52 Compile time support: - AppArmor support is enabled - AppImage support is enabled - bind support is enabled - chroot support is enabled - file and directory whitelisting support is enabled - file transfer support is enabled - git install support is disabled - networking support is enabled - overlayfs support is enabled - private-home support is enabled - seccomp-bpf support is enabled - user namespace support is enabled - X11 sandboxing support is enabled Could you help me resolving the issue?

gitea-mirror closed this issue

2026-05-05 07:47:19 -06:00

gitea-mirror commented

2026-05-05 07:47:22 -06:00

Author

Owner

@Vincent43 commented on GitHub (Apr 29, 2018):

Those logs indicate that libreoffice is contained in AppArmor profile but in complain state which still can interfere with firejail. Can you try running firejail --apparmor libreoffice which should force using firejail-default AppArmor profile instead of libreoffice one?

Also if you don't use java with libreoffice you can start it unsandboxed and disable java.

@Vincent43 commented on GitHub (Apr 29, 2018): Those logs indicate that libreoffice is contained in AppArmor profile but in complain state which still can interfere with firejail. Can you try running `firejail --apparmor libreoffice` which should force using firejail-default AppArmor profile instead of libreoffice one? Also if you don't use java with libreoffice you can start it unsandboxed and disable java.

gitea-mirror commented

2026-05-05 07:47:24 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Apr 29, 2018):

@Vincent43 I've just tested and firejail --apparmor libreoffice does work for my Ubuntu 18.04 vm. Funny thing was, so did 00b91bf1cb when building firejail from source (and w/o apparmor support). It'd sure be nice if we can fix this with just apparmor.

@Fred-Barclay commented on GitHub (Apr 29, 2018): @Vincent43 I've just tested and `firejail --apparmor libreoffice` does work for my Ubuntu 18.04 vm. Funny thing was, so did 00b91bf1cb1e04d405990ae7b2395386c7fde3fe when building firejail from source (and w/o apparmor support). It'd sure be nice if we can fix this with just `apparmor`.

gitea-mirror commented

2026-05-05 07:47:25 -06:00

Author

Owner

@smitsohu commented on GitHub (Apr 30, 2018):

This leaves us with an interesting choice. Since libreoffice-kde has been ported away from old kdelibs4 particularly late (afaik only coming LibreOffice 6.1), apparmor breaks it currently on Kubuntu (due to missing D-Bus).

@smitsohu commented on GitHub (Apr 30, 2018): This leaves us with an interesting choice. Since libreoffice-kde has been ported away from old kdelibs4 particularly late (afaik only coming LibreOffice 6.1), `apparmor` breaks it currently on Kubuntu (due to missing D-Bus).

gitea-mirror commented

2026-05-05 07:47:26 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 30, 2018):

They are bringing in their own apparmor profile for libreoffice, so we need to disable ours. With this fix a6c97ef348 and the previous one 00b91bf1cb from @Fred-Barclay we should be all set.

@derba can you grab the version from mainline git and give it a try? All you have to do is the following:

$ sudo apt-get install build-essential git
$ git clone http://github.com/netblue30/firejail
$ cd firejail
$ ./configure && make && sudo make install
$ sudo firecfg

Thanks.

@netblue30 commented on GitHub (Apr 30, 2018): They are bringing in their own apparmor profile for libreoffice, so we need to disable ours. With this fix https://github.com/netblue30/firejail/commit/a6c97ef348046929a7d8528d10c0949fd64c9b62 and the previous one https://github.com/netblue30/firejail/commit/00b91bf1cb1e04d405990ae7b2395386c7fde3fe from @Fred-Barclay we should be all set. @derba can you grab the version from mainline git and give it a try? All you have to do is the following: ````` $ sudo apt-get install build-essential git $ git clone http://github.com/netblue30/firejail $ cd firejail $ ./configure && make && sudo make install $ sudo firecfg ````` Thanks.

gitea-mirror commented

2026-05-05 07:47:28 -06:00

Author

Owner

@derba commented on GitHub (May 1, 2018):

It works fine.

@derba commented on GitHub (May 1, 2018): It works fine.

gitea-mirror commented

2026-05-05 07:47:29 -06:00

Author

Owner

@derba commented on GitHub (May 1, 2018):

I played with the profile a bit. It seems that commenting out nonewprivs solved the actual issue. When I put back apparmor LO works fine.

@derba commented on GitHub (May 1, 2018): I played with the profile a bit. It seems that commenting out `nonewprivs` solved the actual issue. When I put back `apparmor` LO works fine.

gitea-mirror commented

2026-05-05 07:47:30 -06:00

Author

Owner

@Vincent43 commented on GitHub (May 1, 2018):

@netblue30 keep in mind that libreoffice AppArmor profile is in complain mode by default so it doesn't do anything except printing logs and breaking firejail. I doubt it will be force enabled in ubuntu bionic lifetime. I wonder if we should enable dbus in firejail apparmor profile and control it with nodbus option instead which can be used per profile instead of globally.

@Vincent43 commented on GitHub (May 1, 2018): @netblue30 keep in mind that libreoffice AppArmor profile is in complain mode by default so it doesn't do anything except printing logs and breaking firejail. I doubt it will be force enabled in ubuntu bionic lifetime. I wonder if we should enable dbus in firejail apparmor profile and control it with `nodbus` option instead which can be used per profile instead of globally.

gitea-mirror commented

2026-05-05 07:47:33 -06:00

Author

Owner

@netblue30 commented on GitHub (May 2, 2018):

I'll do a release in the next two/three weeks with what we have now. After that we move to enable dbus in firejail apparmor profile as you suggested.

@netblue30 commented on GitHub (May 2, 2018): I'll do a release in the next two/three weeks with what we have now. After that we move to enable dbus in firejail apparmor profile as you suggested.

gitea-mirror commented

2026-05-05 07:47:34 -06:00

Author

Owner

@smitsohu commented on GitHub (May 12, 2018):

Since Apparmor allows pretty fine grained control of D-Bus, maybe we can try to blacklist some interfaces? Thinking of stuff like NetworkManager and WPASupplicant on system bus, or terminals and scriptable window managers on the session bus. We won't be able to blacklist everything that's dangerous, but limiting an attackers toolkit to some extent should be still possible.

@smitsohu commented on GitHub (May 12, 2018): Since Apparmor allows pretty fine grained control of D-Bus, maybe we can try to blacklist some interfaces? Thinking of stuff like NetworkManager and WPASupplicant on system bus, or terminals and scriptable window managers on the session bus. We won't be able to blacklist everything that's dangerous, but limiting an attackers toolkit to some extent should be still possible.

gitea-mirror commented

2026-05-05 07:47:35 -06:00

Author

Owner

@smitsohu commented on GitHub (Aug 21, 2018):

Now that we don't restrict D-Bus anymore in our Apparmor profile, shouldn't it be possible to enable everything back in the Libreoffice profile?

@smitsohu commented on GitHub (Aug 21, 2018): Now that we don't restrict D-Bus anymore in our Apparmor profile, shouldn't it be possible to enable everything back in the Libreoffice profile?

gitea-mirror commented

2026-05-05 07:47:37 -06:00

Author

Owner

@Vincent43 commented on GitHub (Aug 21, 2018):

Yeah, we may try 😄

@Vincent43 commented on GitHub (Aug 21, 2018): Yeah, we may try :smile:

gitea-mirror commented

2026-05-05 07:47:38 -06:00

Author

Owner

@smitsohu commented on GitHub (Aug 22, 2018):

You convinced me 😄 Let's see if we find the courage during in the next development cycle...

@smitsohu commented on GitHub (Aug 22, 2018): You convinced me :smile: Let's see if we find the courage during in the next development cycle...

gitea-mirror commented

2026-05-05 07:47:39 -06:00

Author

Owner

@smitsohu commented on GitHub (Aug 22, 2018):

Sending the issue back to sleep

@smitsohu commented on GitHub (Aug 22, 2018): Sending the issue back to sleep

gitea-mirror referenced this issue

2026-05-05 10:10:10 -06:00

[PR #1283] [CLOSED] allow python3 for youtube-dl in MPV profile #3907

Rows
Columns

[GH-ISSUE #1917] LibreOffice won't start on Ubuntu 18.04 #1283