[GH-ISSUE #2013] profile weechat broken

gitea-mirror commented

2026-05-05 07:55:16 -06:00

Owner

Originally created by @cyrinux on GitHub (Jun 27, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2013

Hi, weechat profile is broken

❯ weechat            
Reading profile /etc/firejail/weechat.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Parent pid 26649, child pid 26650
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: cleaning all supplementary groups
Child process initialized in 62.03 ms
Error: unable to create/append to log file (weechat.log)
If another WeeChat process is using this file, try to run WeeChat
with another home using the "--dir" command line option.

Parent is shutting down, bye...

Originally created by @cyrinux on GitHub (Jun 27, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2013 Hi, weechat profile is broken ``` ❯ weechat Reading profile /etc/firejail/weechat.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Parent pid 26649, child pid 26650 Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Warning: cleaning all supplementary groups Child process initialized in 62.03 ms Error: unable to create/append to log file (weechat.log) If another WeeChat process is using this file, try to run WeeChat with another home using the "--dir" command line option. Parent is shutting down, bye... ```

gitea-mirror closed this issue

2026-05-05 07:55:17 -06:00

gitea-mirror commented

2026-05-05 07:55:20 -06:00

Author

Owner

@ghost commented on GitHub (Jun 28, 2018):

@cyrinux For me weechat 2.1 is working fine with latest firejail from git. The error 'unable to create/append to log file (weechat.log)' might prove worthwhile looking into. Have you tried that yet? Something like the below would rule out any WeeChat process conflicts:

(1) copy regular weechat config dir to a test dir
$ cp -fr $HOME/.weechat $HOME/.weechat-test
(2) run firejailed weechat using the created test dir
$ firejail --whitelist=$HOME/.weechat-test /usr/bin/weechat

After this test you can safely remove the created test dir. If you could provide output of those commands here, together with firejail version info, people would be in a better position to get to the bottom of your issue.

Regards

@ghost commented on GitHub (Jun 28, 2018): @cyrinux For me weechat 2.1 is working fine with latest firejail from git. The error 'unable to create/append to log file (weechat.log)' might prove worthwhile looking into. Have you tried that yet? Something like the below would rule out any WeeChat process conflicts: ``` (1) copy regular weechat config dir to a test dir $ cp -fr $HOME/.weechat $HOME/.weechat-test (2) run firejailed weechat using the created test dir $ firejail --whitelist=$HOME/.weechat-test /usr/bin/weechat ``` After this test you can safely remove the created test dir. If you could provide output of those commands here, together with firejail version info, people would be in a better position to get to the bottom of your issue. Regards

gitea-mirror commented

2026-05-05 07:55:22 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Jun 28, 2018):

Also does firejail --noprofile weechat work?

@Fred-Barclay commented on GitHub (Jun 28, 2018): Also does `firejail --noprofile weechat` work?

gitea-mirror commented

2026-05-05 07:55:24 -06:00

Author

Owner

@cyrinux commented on GitHub (Jun 28, 2018):

Hi,

It is with archlinux updated running weechat 2.1 and firejail 0.9.54~rc2

With noprofile, I confirm this works normally.

For the first try which start weechat without configuration.

@cyrinux commented on GitHub (Jun 28, 2018): Hi, It is with archlinux updated running weechat 2.1 and firejail 0.9.54~rc2 With noprofile, I confirm this works normally. For the first try which start weechat without configuration.

gitea-mirror commented

2026-05-05 07:55:25 -06:00

Author

Owner

@ghost commented on GitHub (Jun 29, 2018):

If --noprofile is working the issue isn't with the firejail profile. Your error message suggests there were several weechat processes running and apparently one of those had an exclusive lock on ~/.weechat/weechat.log. That's why I suggested to test with a temporary copy of your ~/.weechat dir to confirm all this. But I see now there was an ommision in the commands I gave above, my bad. The last command (to test firejailed weechat with a temp dir) should read:

$ firejail --whitelist=$HOME/.weechat-test /usr/bin/weechat --dir $HOME/.weechat-test

You could rm -f ~/.weechat-test/weechat.log from the test dir before running that, it should be recreated by WeeChat on a succesful start. Hope this helps.

@ghost commented on GitHub (Jun 29, 2018): If --noprofile is working the issue isn't with the firejail profile. Your error message suggests there were several weechat processes running and apparently one of those had an exclusive lock on ~/.weechat/weechat.log. That's why I suggested to test with a temporary copy of your ~/.weechat dir to confirm all this. But I see now there was an ommision in the commands I gave above, my bad. The last command (to test firejailed weechat with a temp dir) should read: ``` $ firejail --whitelist=$HOME/.weechat-test /usr/bin/weechat --dir $HOME/.weechat-test ``` You could rm -f ~/.weechat-test/weechat.log from the test dir before running that, it should be recreated by WeeChat on a succesful start. Hope this helps.

gitea-mirror commented

2026-05-05 07:55:26 -06:00

Author

Owner

@cyrinux commented on GitHub (Jun 29, 2018):

Hi @glitsj16, thanks, this try works, without removing the log

@cyrinux commented on GitHub (Jun 29, 2018): Hi @glitsj16, thanks, this try works, without removing the log

gitea-mirror commented

2026-05-05 07:55:27 -06:00

Author

Owner

@cyrinux commented on GitHub (Jul 1, 2018):

So here the working profile

# Firejail profile for weechat
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/weechat.local
# Persistent global definitions
include /etc/firejail/globals.local

noblacklist ${HOME}/.weechat
whitelist ${HOME}/.weechat

include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc

caps.drop all
netfilter
nodvd
nonewprivs
noroot
notv
protocol unix,inet,inet6
seccomp

# no private-bin support for various reasons:
# Plugins loaded: alias, aspell, charset, exec, fifo, guile, irc,
# logger, lua, perl, python, relay, ruby, script, tcl, trigger, xferloading plugins

@cyrinux commented on GitHub (Jul 1, 2018): So here the working profile ``` # Firejail profile for weechat # This file is overwritten after every install/update # Persistent local customizations include /etc/firejail/weechat.local # Persistent global definitions include /etc/firejail/globals.local noblacklist ${HOME}/.weechat whitelist ${HOME}/.weechat include /etc/firejail/disable-common.inc include /etc/firejail/disable-programs.inc caps.drop all netfilter nodvd nonewprivs noroot notv protocol unix,inet,inet6 seccomp # no private-bin support for various reasons: # Plugins loaded: alias, aspell, charset, exec, fifo, guile, irc, # logger, lua, perl, python, relay, ruby, script, tcl, trigger, xferloading plugins ```

gitea-mirror commented

2026-05-05 07:55:29 -06:00

Author

Owner

@alrayyes commented on GitHub (Mar 13, 2019):

This isn't a weechat issue. The default profile doesn't allow writing to the logfile period. The error weechat throws isn't very helpful in this regard.

This is easily fixed with the following profile:

include /etc/firejail/weechat.profile
read-write ${HOME}/dotfiles/weechat/.weechat/weechat.log

According to the documentation writing weechat.log to ~/.weechat is default behaviour, therefore the read-write line should be added to the default weechat firejail profile.

@alrayyes commented on GitHub (Mar 13, 2019): This isn't a weechat issue. The default profile doesn't allow writing to the logfile period. The error weechat throws isn't very helpful in this regard. This is easily fixed with the following profile: ``` include /etc/firejail/weechat.profile read-write ${HOME}/dotfiles/weechat/.weechat/weechat.log ``` According to the [documentation](https://weechat.org/files/doc/stable/weechat_user.en.html) writing weechat.log to ~/.weechat is default behaviour, therefore the read-write line should be added to the default weechat firejail profile.

gitea-mirror commented

2026-05-05 07:55:30 -06:00

Author

Owner

@ghost commented on GitHub (Mar 13, 2019):

@alrayyes Nobody suggested it was/is a weechat issue.

If --noprofile is working the issue isn't with the firejail profile.

That remark was related to help the OP in debugging what was going on exactly. Since then the weechat.profile has changed and doesn't have the 'whitelist ${HOME}/.weechat' any longer. But it still has 'noblacklist ${HOME}/.weechat' to counterpart blacklisting done via the included 'disable-programs.inc' (a common practice in firejail profiles). Having noblacklist ${HOME}/.weechat already takes care of making ${HOME}/.weechat read-write.

read-write ${HOME}/dotfiles/weechat/.weechat/weechat.log

As far as I can read in weechat's documentation that isn't weechat's default home dir location. If you use the -d/--dir (or an env var for that matter) with weechat to override its default home dir you should do the same for its firejail profile and add that custom path in a weechat.local file (either in /etc for system-wide support or in ~/.config/firejail for per user support). Is this not working for you?

@ghost commented on GitHub (Mar 13, 2019): @alrayyes Nobody suggested it was/is a weechat issue. > If --noprofile is working the issue isn't with the firejail profile. That remark was related to help the OP in debugging what was going on exactly. Since then the weechat.profile has changed and doesn't have the 'whitelist ${HOME}/.weechat' any longer. But it still has 'noblacklist ${HOME}/.weechat' to counterpart blacklisting done via the included 'disable-programs.inc' (a common practice in firejail profiles). Having `noblacklist ${HOME}/.weechat` already takes care of making ${HOME}/.weechat read-write. > read-write ${HOME}/dotfiles/weechat/.weechat/weechat.log As far as I can read in weechat's documentation that isn't weechat's default home dir location. If you use the -d/--dir <path> (or an env var for that matter) with weechat to override its default home dir you should do the same for its firejail profile and add that custom path in a weechat.local file (either in /etc for system-wide support or in ~/.config/firejail for per user support). Is this not working for you?

gitea-mirror commented

2026-05-05 07:55:30 -06:00

Author

Owner

@alrayyes commented on GitHub (Mar 13, 2019):

Ah, i see what i did there. I meant it's a dotfiles issue. Don't know why I said that was the default location, makes no sense. You're right.

I use the above in ~/.config/firejail/weechat.profile and it works for me. The issue is read-only ${HOME}/dotfiles in /etc/firejail/disable-common.inc. Commenting that line out fixed the issue for me (hence the read-write override above).

It generally does make sense to keep dotfiles read only, but for me (and probably a lot of other people) ~/.weechat is symlinked to ~/dotfiles/weechat/.weechat. Anyway nvm. Hopefully the next person to google this problem will see this and it will save them a little time :)

@alrayyes commented on GitHub (Mar 13, 2019): Ah, i see what i did there. I meant it's a dotfiles issue. Don't know why I said that was the default location, makes no sense. You're right. I use the above in ~/.config/firejail/weechat.profile and it works for me. The issue is `read-only ${HOME}/dotfiles` in /etc/firejail/disable-common.inc. Commenting that line out fixed the issue for me (hence the read-write override above). It generally does make sense to keep dotfiles read only, but for me (and probably a lot of other people) ~/.weechat is symlinked to ~/dotfiles/weechat/.weechat. Anyway nvm. Hopefully the next person to google this problem will see this and it will save them a little time :)

gitea-mirror referenced this issue

2026-05-05 08:03:49 -06:00

[GH-ISSUE #2071] [bug] Whitelisting a file leads to inability to write to it #1399

gitea-mirror referenced this issue

2026-05-05 08:28:15 -06:00

[GH-ISSUE #2874] Write to console error message when trying to rename a whitelisted file #1797

gitea-mirror referenced this issue

2026-05-05 08:28:18 -06:00

[GH-ISSUE #2873] keepassxc: cannot save database file (whitelisting issue) #1796

Rows
Columns

[GH-ISSUE #2013] profile weechat broken #1355