mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #2027] Can't run firefox, chromium through firejail. #1364
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1364
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ghost on GitHub (Jul 5, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2027
Hi guys,
Im using firejail version 0.9.54 on openSUSE Leap 15`
I can't seem to run firefox or chromium with firejail. I get this error
"Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set."
However vlc, gwenview runs okay.
Here is the full output
(chromium:4):
Gtk-WARNING **: cannot open display: :0
Parent is shutting down, bye...
I have tried using the firejail LTS version but no luck.
Some of other methods i tried are from this post:
https://github.com/netblue30/firejail/issues/1885
I did sudo firecfg --clean + firejail chromium: and still no luck.
Any idea how I should proceed?
@Fred-Barclay commented on GitHub (Jul 5, 2018):
What happens with
firejail --noprofile chromiumorfirejail --noprofile firefox?@ghost commented on GitHub (Jul 6, 2018):
@Fred-Barclay Chromium and Firefox does run but its I can access files from the browser "file:///home/user/"
So i guess its not sandboxed?
@chiraag-nataraj commented on GitHub (Jul 8, 2018):
@OMslaw04 Yeah, that's the point of the
--noprofile. So it seems as though (from the errors in your original post) that chromium doesn't have access to the X11 display (the lineGtk-WARNING **: cannot open display: :0). Are you using the default profiles? If not, can you post your profile?Also, another way to debug is to go through the profile and comment out specific lines to see what breaks chromium (and/or firefox).
@ghost commented on GitHub (Jul 9, 2018):
@chiraag-nataraj thanks for the tip on debugging. I will test on that.
Yes i am using default profile as shown below.
@chiraag-nataraj commented on GitHub (Jul 9, 2018):
One thing you can also try is using the
chromiumprofile that I use. Keep in mind that for various reasons, you should either comment outprivate-binor runchromiumasfirejail /usr/lib/chromium/chromium. Also, note that to install this profile, simply copy both files to~/.config/firejail/and rename them tochromium.profileandcommon.increspectively.chromium.txt
common.txt
@chiraag-nataraj commented on GitHub (Jul 11, 2018):
@OMslaw04 Were you able to debug the profile to see what was breaking (or use the profile I provided)?
@ghost commented on GitHub (Jul 13, 2018):
@chiraag-nataraj here is the result with the two files coped to ~/.config/firejail
So if i were to comment the
private binline I have issue accessing to the X11 fileserror:
(chromium:9): Gtk-WARNING **: cannot open display: :0on the other hand if i uncomment I get this.
Reading profile /home/ohms/.config/firejail/chromium.profileReading profile /home/ohms/.config/firejail/common.incParent pid 22080, child pid 22081Warning: skipping chromium.d for private /etcPrivate /etc installed in 15.19 msWarning: skipping emp for private /optPrivate /opt installed in 0.04 ms11 programs installed in 13.05 msWarning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.Child process initialized in 39.13 msParent is shutting down, bye...I also had to comment
nou2ffromcommon.incI tried commenting line by line in
common.incbut I get this errorReading profile /home/ohms/.config/firejail/chromium.profileReading profile /home/ohms/.config/firejail/common.incError: line 22 in /home/ohms/.config/firejail/common.inc is invalidwhich I don't think is the way to go.
@chiraag-nataraj commented on GitHub (Jul 13, 2018):
Can you use
firejail --debug chromiumand either post or attach the output (if the output is really long, please attach it as a separate file!).Oh yeah sorry about that - I added
nou2finmasterand forgot that it's not in0.9.54😜@ghost commented on GitHub (Jul 19, 2018):
@chiraag-nataraj https://pastebin.com/Pn7kJsiT here is the output for
firejail --debug chromium@chiraag-nataraj commented on GitHub (Jul 21, 2018):
Can you run
firejail --debugwithprivate-bincommented (so that we get thecannot open display: :0error along with firejail's debug output)?@ghost commented on GitHub (Jul 25, 2018):
https://pastebin.com/8P0AQ3wG
here is the output to
firejail --debugwithprivate-bincommented @chiraag-nataraj@chiraag-nataraj commented on GitHub (Jul 25, 2018):
Yeah, this is really weird. Let's ignore the profile I gave you for the moment and go back to the default profile (the one you were using). Can you go through and comment stuff until it works? That might give us a good idea of where to get started in terms of finding the issue.
@chewblacka commented on GitHub (Jul 27, 2018):
Hi just posting to say I am also running Open Suse Leap 15.0 and firefox in firejail was working fine up until a week or so ago. But now for some reason it conks out with
Permission Denied:https://pastebin.com/cKXTt49X
firejail --debug firefoxgives the following:https://pastebin.com/HDb9bybF
firejail --noprofile firefoxworks but unsandboxed (as expected).@SkewedZeppelin commented on GitHub (Jul 27, 2018):
To confirm @chewblacka and @OMslaw04 you both installed from git/make install, yes?
@chewblacka commented on GitHub (Jul 27, 2018):
@SkewedZeppelin I initially installed 0.9.55 from git with
./configure --enable-apparmorand that was working fine with firefox until it stopped working a few days ago. Then today I installed 0.9.54 from tarball again using--enable-apparmorandmakebut the problem persists. Other things (e.g. virtualbox, okular) are working fine with firejail.@ghost commented on GitHub (Aug 1, 2018):
@chiraag-nataraj
chromiumprofile.txt
So this is my default profile.
I tried commenting every line and run
firejail chromiumI would always get
All of these can't seem to fetch the display.
By default line 18
#private-bin chromium,chromium-browser,chromedriveris commented.If i were to uncomment I would end up with
I am so clueless right now.
@SkewedZeppelin yes correct.
@chiraag-nataraj commented on GitHub (Aug 1, 2018):
@OMslaw04 So if you comment out everything in
chromium.profile, it still doesn't run? That should be the same as--noprofilethough.If commenting out all lines works, can you go through and slowly uncomment particular lines (or groups of lines if necessary - e.g. whitelists) to see what breaks it?
@chewblacka commented on GitHub (Aug 1, 2018):
Mods, should I carry on posting in this thread or start my own thread?
I've discovered that if I compile firejail without apparmor support firefox works, so apparmor seems to be the issue. Is it possible that an update to OpenSuse Leap borked something?
Speaking of apparmor do I need to run:
aa-enforce firejail-defaultbecause when I do I get the error:
Setting /etc/apparmor.d/firejail-default to enfoce mode.ERROR: Path doesn't start with / or variable: firejail-default@chiraag-nataraj commented on GitHub (Aug 6, 2018):
@chewblacka I had the same issue, and a reboot fixed it (I suspect it has to do with an apparmor upgrade). Can you try
sudo aa-disable firefox? If you check your logs, you'll probably see something likeapparmorblockingfirejailfrom applying certain things because of thefirefoxapparmor profile (e.g.nonewprivs).@chiraag-nataraj commented on GitHub (Aug 6, 2018):
@OMslaw04 What is the result when you comment out everything in
chromium.profile?@chewblacka commented on GitHub (Aug 6, 2018):
thanks @chiraag-nataraj, are you using openSUSE too?
It is definitely to do with apparmor (most likely an upgrade as you say). I compiled firejail without apparmor support and it worked fine. So I recompiled firejail with apparmor support and have added the noapparmor option in the firejail firefox conf. Everything is working ok now.
@chiraag-nataraj commented on GitHub (Aug 7, 2018):
@chewblacka Good to hear. Nope, I'm using Debian sid/experimental, but I have a more "standard" Debian VM which enabled apparmor by default, and I ran into some of these issues.
@ghost commented on GitHub (Aug 9, 2018):
@chiraag-nataraj with everything commented it runs. Like you said it runs like
--noprofile@chewblacka I am on OpenSUSE Leap 15 too, I complied with AppArmour and still no luck.
@uli13 commented on GitHub (Aug 11, 2018):
I am an openSUSE user too. FIrejail works in Tumbleweed but not in LEAP15 with the same output:
Gtk-WARNING **: cannot open display: :0and for firefox
Unable to init server: Could not connect: Connection refused Error: cannot open display: :0I am using firejail 0.9.54 and it works with
--noprofile. I use the standard profile but I commented out apparmor that made firejail work in Tumbleweed but had no effect in Leap15.The command
aa-disable firefox Profile for /usr/lib64/firefox/firefox.sh not found, skippingSimilar for chromium. Any help is appreciated
@chiraag-nataraj commented on GitHub (Aug 12, 2018):
@OMslaw04 Okay. Now go through and re-enable stuff until it breaks. That's how we can figure out what is breaking it.
@Vincent43 commented on GitHub (Aug 14, 2018):
For people with issues on OpenSuse Leap 15 and apparmor, can you try if this fix works for you?
@chewblacka commented on GitHub (Aug 15, 2018):
Thanks @Vincent43, that worked perfectly for my OpenSuse Leap 15 KDE install! Apparmor now working as it should. Many thanks for the help!
@chiraag-nataraj commented on GitHub (Aug 16, 2018):
@OMslaw04 Can you report back with which thing actually breaks your setup? Then we can fix this :) Or, if your issue is fixed by what @Vincent43 linked to, can you also report back? That way we know this issue is solved.
@wofwofwof commented on GitHub (Sep 21, 2018):
Not sure if it is the same issue, but I had the same problem on gentoo with thunderbird and it was fixed with adding unix to the protocol.
@chiraag-nataraj commented on GitHub (May 19, 2019):
Is this still an issue for whoever commented and is still on Github?
@chiraag-nataraj commented on GitHub (May 29, 2019):
I'm going to close this for inactivity. If someone is still having this issue, please feel free to re-open it.
@ghost commented on GitHub (Sep 29, 2021):
Hi there!
You just need to export your XAuthority properly. A whitelist entry for the authority file afterwards will grant you access within the sandbox (e.g. --whitelist=/home/user/.xauthxxxxXX) [tested with GrSec/Selinux/Apparmor/su sandbox -> firejail]
Cheers!