github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2005] [question] opening a PDF from within firefox using atril used to work, then stopped working #1349

New issue

Closed

opened 2026-05-05 07:54:51 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 07:54:51 -06:00

Owner

Originally created by @jmcclelland on GitHub (Jun 19, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2005

This problem presents in both firefox and thunderbird.

Here's my console output:


0 jamie@turkey:~$ firefox 
Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/firefox-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 6024, child pid 6025
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Post-exec seccomp protector enabled
Warning fseccomp: syscall "ni_syscall" not available on this platform
Warning fseccomp: syscall "umount" not available on this platform
Seccomp list in: @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice, check list: @default-keep, prelist: adjtimex,clock_adjtime,clock_settime,settimeofday,modify_ldt,lookup_dcookie,perf_event_open,process_vm_writev,delete_module,finit_module,init_module,_sysctl,afs_syscall,create_module,get_kernel_syms,getpmsg,putpmsg,query_module,security,sysfs,tuxcall,uselib,ustat,vserver,ioperm,iopl,kexec_load,kexec_file_load,reboot,set_mempolicy,migrate_pages,move_pages,mbind,swapon,swapoff,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount2,userfaultfd,vhangup,vmsplice,
Child process initialized in 115.03 ms

Then, I click on a PDF link on a web page and firefox prompts me to open it using atril and i click to open it and...

(atril:191): GLib-GIO-CRITICAL **: 16:15:34.298: g_dbus_proxy_new_sync: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

I "fixed" the problem by adding the file:

1 jamie@turkey:~$ cat /etc/firejail/firefox-common.local 
ignore nodbus
0 jamie@turkey:~$

I'm not really sure what this mean or if this is an appropriate or safe fix to the problem or is there a better way to resolve it?

Thanks for all the work you do on this project.

Originally created by @jmcclelland on GitHub (Jun 19, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2005 This problem presents in both firefox and thunderbird. Here's my console output: ``` 0 jamie@turkey:~$ firefox Reading profile /etc/firejail/firefox.profile Reading profile /etc/firejail/firefox-common.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 6024, child pid 6025 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Post-exec seccomp protector enabled Warning fseccomp: syscall "ni_syscall" not available on this platform Warning fseccomp: syscall "umount" not available on this platform Seccomp list in: @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice, check list: @default-keep, prelist: adjtimex,clock_adjtime,clock_settime,settimeofday,modify_ldt,lookup_dcookie,perf_event_open,process_vm_writev,delete_module,finit_module,init_module,_sysctl,afs_syscall,create_module,get_kernel_syms,getpmsg,putpmsg,query_module,security,sysfs,tuxcall,uselib,ustat,vserver,ioperm,iopl,kexec_load,kexec_file_load,reboot,set_mempolicy,migrate_pages,move_pages,mbind,swapon,swapoff,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount2,userfaultfd,vhangup,vmsplice, Child process initialized in 115.03 ms ``` Then, I click on a PDF link on a web page and firefox prompts me to open it using atril and i click to open it and... ``` (atril:191): GLib-GIO-CRITICAL **: 16:15:34.298: g_dbus_proxy_new_sync: assertion 'G_IS_DBUS_CONNECTION (connection)' failed ``` I "fixed" the problem by adding the file: ``` 1 jamie@turkey:~$ cat /etc/firejail/firefox-common.local ignore nodbus 0 jamie@turkey:~$ ``` I'm not really sure what this mean or if this is an appropriate or safe fix to the problem or is there a better way to resolve it? Thanks for all the work you do on this project.

gitea-mirror

2026-05-05 07:54:51 -06:00

closed this issue
added the
question_old
label

gitea-mirror commented

2026-05-05 07:54:56 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Jun 20, 2018):

G'day @jmcclelland
With the last release of firejail (0.9.54) we blocked access to dbus for most Linux distros. It's a security feature as dbus can be used to escape the firejail sandbox, but it can also lead to inconveniences like what you're seeing.
ignore dbus does loosen the security of the firejail sandbox a bit, but it's still just as good as it has been in previous versions of firejail. If you're comfortable with this and would like to open pdfs from firejail, then ignore dbus is the way to go. 😄

Cheers!
Fred

@Fred-Barclay commented on GitHub (Jun 20, 2018): G'day @jmcclelland With the last release of firejail (0.9.54) we blocked access to dbus for most Linux distros. It's a security feature as dbus can be used to escape the firejail sandbox, but it can also lead to inconveniences like what you're seeing. `ignore dbus` does loosen the security of the firejail sandbox a bit, but it's still just as good as it has been in previous versions of firejail. If you're comfortable with this and would like to open pdfs from firejail, then `ignore dbus` is the way to go. :smile: Cheers! Fred

gitea-mirror commented

2026-05-05 07:54:58 -06:00

Author

Owner

@jmcclelland commented on GitHub (Jun 20, 2018):

Thanks - just the answer I was looking for.

@jmcclelland commented on GitHub (Jun 20, 2018): Thanks - just the answer I was looking for.

gitea-mirror referenced this issue

2026-05-05 10:10:27 -06:00

[PR #1354] [MERGED] More fixes for #1349 and 1acfd077b124cbfc8ed257f0c0aacf4f4cbaba38 #3924

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1349

No description provided.

Rows
Columns