github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1939] Firefox version 60 breaks completely with the default Firejail profile or any profile containing seccomp. #1294

New issue

Closed

opened 2026-05-05 07:48:50 -06:00 by gitea-mirror · 12 comments

gitea-mirror commented

2026-05-05 07:48:50 -06:00

Owner

Originally created by @dkwls on GitHub (May 11, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1939

Originally created by @dkwls on GitHub (May 11, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1939

gitea-mirror closed this issue

2026-05-05 07:48:51 -06:00

gitea-mirror commented

2026-05-05 07:48:53 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (May 11, 2018):

See #1930 and #1937

The fix (#1935) has been merged and is in master as 64914b7ae7

@SkewedZeppelin commented on GitHub (May 11, 2018): See #1930 and #1937 The fix (#1935) has been merged and is in master as 64914b7ae78484483dd0f736f3eefcec4342482e

gitea-mirror commented

2026-05-05 07:48:54 -06:00

Author

Owner

@dkwls commented on GitHub (May 11, 2018):

Thanks for the response. I may be missing something but weather or not tracelog is in the profile appears to have no effect at least in version 0.9.52. Commenting out seccomp is the only way I have found to get Firefox to work again. I have tested this problem in Ubuntu 18.04 and 17.10.

@dkwls commented on GitHub (May 11, 2018): Thanks for the response. I may be missing something but weather or not tracelog is in the profile appears to have no effect at least in version 0.9.52. Commenting out seccomp is the only way I have found to get Firefox to work again. I have tested this problem in Ubuntu 18.04 and 17.10.

gitea-mirror commented

2026-05-05 07:48:56 -06:00

Author

Owner

@smitsohu commented on GitHub (May 11, 2018):

@dkwls Which Firejail version do you use?

EDIT:

appears to have no effect at least in version 0.9.52

I should read more carefully 😄

@smitsohu commented on GitHub (May 11, 2018): @dkwls Which Firejail version do you use? EDIT: > appears to have no effect at least in version 0.9.52 I should read more carefully :smile:

gitea-mirror commented

2026-05-05 07:48:57 -06:00

Author

Owner

@smitsohu commented on GitHub (May 11, 2018):

We had to take out chroot from the seccomp filter to get Firefox working. If you replace seccomp with the following long line it should work again:

seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice

This will be fixed in 0.9.54.

@smitsohu commented on GitHub (May 11, 2018): We had to take out chroot from the seccomp filter to get Firefox working. If you replace `seccomp` with the following long line it should work again: `seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice` This will be fixed in 0.9.54.

gitea-mirror commented

2026-05-05 07:48:58 -06:00

Author

Owner

@Vincent43 commented on GitHub (May 11, 2018):

Here's some info about sandboxing in FF 60: https://www.morbo.org/2018/05/linux-sandboxing-improvements-in_10.html

@Vincent43 commented on GitHub (May 11, 2018): Here's some info about sandboxing in FF 60: https://www.morbo.org/2018/05/linux-sandboxing-improvements-in_10.html

gitea-mirror commented

2026-05-05 07:48:59 -06:00

Author

Owner

@Wolf-Italy commented on GitHub (May 11, 2018):

To your kind attention.

I would like to point out, a problem between firejail and the
new version of Firefox 60.0

I just installed the new version of Firefox 60.0,
in Linux Mint 18.3 Sylvia

I use LTS version firejail_0.9.38.12_1_amd64.deb

The Browser starts, but the page remains blank.

See screenshots:

https://imgur.com/a/YE2L2Et

This problem seems to be the same, which happened a while ago,
With the Sandboxie program, the problem was due to
Multiprocess function.

Translated with www.DeepL.com/Translator

@Wolf-Italy commented on GitHub (May 11, 2018): To your kind attention. I would like to point out, a problem between firejail and the new version of Firefox 60.0 I just installed the new version of Firefox 60.0, in Linux Mint 18.3 Sylvia I use LTS version firejail_0.9.38.12_1_amd64.deb The Browser starts, but the page remains blank. See screenshots: https://imgur.com/a/YE2L2Et This problem seems to be the same, which happened a while ago, With the Sandboxie program, the problem was due to Multiprocess function. Translated with www.DeepL.com/Translator

gitea-mirror commented

2026-05-05 07:49:01 -06:00

Author

Owner

@dkwls commented on GitHub (May 11, 2018):

@smitsohu thank you that fixed the problem for me.

@dkwls commented on GitHub (May 11, 2018): @smitsohu thank you that fixed the problem for me.

gitea-mirror commented

2026-05-05 07:49:02 -06:00

Author

Owner

@Queeq commented on GitHub (May 12, 2018):

I tried using seccomp.keep option instead of listing all syscalls explicitly (this is much cleaner), but it then fails to start:

Error: cannot establish communication with the parent, exiting...

Do I understand its function incorrectly?

firejail version 0.9.38.10
Linux Mint 18.3

@Queeq commented on GitHub (May 12, 2018): I tried using `seccomp.keep` option instead of listing all syscalls explicitly (this is much cleaner), but it then fails to start: ``` Error: cannot establish communication with the parent, exiting... ``` Do I understand its function incorrectly? firejail version 0.9.38.10 Linux Mint 18.3

gitea-mirror commented

2026-05-05 07:49:03 -06:00

Author

Owner

@Vincent43 commented on GitHub (May 12, 2018):

seccomp.keep is the opposite of secomp.drop, it creates whitelist instead of blacklist. You have to pass explicitly each allowed syscall, probably not what you want.

@Vincent43 commented on GitHub (May 12, 2018): `seccomp.keep` is the opposite of `secomp.drop`, it creates whitelist instead of blacklist. You have to pass explicitly each allowed syscall, probably not what you want.

gitea-mirror commented

2026-05-05 07:49:04 -06:00

Author

Owner

@Queeq commented on GitHub (May 12, 2018):

Right, so I was trying to pass chroot.

@Queeq commented on GitHub (May 12, 2018): Right, so I was trying to pass chroot.

gitea-mirror commented

2026-05-05 07:49:05 -06:00

Author

Owner

@Wolf-Italy commented on GitHub (May 13, 2018):

To your kind attention.

As indicated, in Support I installed firejail_0.9.54~rc2_1_amd64.deb
Firefox 60.0 works correctly.

See screenshot:

https://imgur.com/a/YOovTGx

Thank you.

@Wolf-Italy commented on GitHub (May 13, 2018): To your kind attention. As indicated, in Support I installed firejail_0.9.54~rc2_1_amd64.deb Firefox 60.0 works correctly. See screenshot: https://imgur.com/a/YOovTGx Thank you.

gitea-mirror commented

2026-05-05 07:49:06 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (May 13, 2018):

@Wolf-Italy Excellent, that's exactly what we want to hear. Thanks!

@Fred-Barclay commented on GitHub (May 13, 2018): @Wolf-Italy Excellent, that's exactly what we want to hear. Thanks!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1294

No description provided.

Rows
Columns