[GH-ISSUE #2026] Firejail breaks Gnome Shell connector

gitea-mirror commented

2026-05-05 07:55:50 -06:00

Owner

Originally created by @ghost on GitHub (Jul 4, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2026

I was unable to check for extension updates via https://extensions.gnome.org as both Firefox and Chromium couldn't find a Gnome connector (Firefox: "native host connector is not detected", Chromium: "native host has exited").

Since chrome-gnome-shell (the connector) is already installed, I tried to run chromium from the terminal and I saw this:

LaunchProcess: failed to execvp:
/usr/bin/chrome-gnome-shell

If I delete the browser's symlink to firejail from /usr/local/bin the connector is detected and everything works.

I'm using firejail 0.9.54-1 on arch linux.

Originally created by @ghost on GitHub (Jul 4, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2026 I was unable to check for extension updates via https://extensions.gnome.org as both Firefox and Chromium couldn't find a Gnome connector (Firefox: "native host connector is not detected", Chromium: "native host has exited"). Since chrome-gnome-shell (the connector) is already installed, I tried to run chromium from the terminal and I saw this: > LaunchProcess: failed to execvp: > /usr/bin/chrome-gnome-shell If I delete the browser's symlink to firejail from /usr/local/bin the connector is detected and everything works. I'm using firejail 0.9.54-1 on arch linux.

gitea-mirror closed this issue

2026-05-05 07:55:51 -06:00

gitea-mirror commented

2026-05-05 07:55:53 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 4, 2018):

Hmm, is there an active (not commented out) private-bin in your profile? The error would suggest that /usr/bin/chrome-gnome-shell isn't available in the sandbox (which would suggest that private-bin is active). Another possibility is that something like the seccomp filter is breaking it.

Since I don't use Gnome, I can't test this for you, but the easiest way of debugging this is to use --ignore=<blah> on the terminal or comment stuff out in the profile (maybe copy the system profile to ~/.config/firejail and modify that file so that you don't mess with the installed files) and see what breaks the connector.

@chiraag-nataraj commented on GitHub (Jul 4, 2018): Hmm, is there an active (not commented out) `private-bin` in your profile? The error would suggest that `/usr/bin/chrome-gnome-shell` isn't available in the sandbox (which would suggest that `private-bin` is active). Another possibility is that something like the `seccomp` filter is breaking it. Since I don't use Gnome, I can't test this for you, but the easiest way of debugging this is to use `--ignore=<blah>` on the terminal or comment stuff out in the profile (maybe copy the system profile to `~/.config/firejail` and modify that file so that you don't mess with the installed files) and see what breaks the connector.

gitea-mirror commented

2026-05-05 07:55:54 -06:00

Author

Owner

@ghost commented on GitHub (Jul 4, 2018):

Ok, some progress: if I comment out BOTH nodbus and the line include /etc/firejail/disable-interpreters.inc in firefox-common.profile and chromium-common.profile the problem goes away.

The above change also solved a problem I've been having recently (perhaps after an update), where my default browser, Firefox, kept warning it wasn't set as default, every single time I started it.

BTW, no private-bin is active anywhere in the profile files.

@ghost commented on GitHub (Jul 4, 2018): Ok, some progress: if I comment out BOTH `nodbus` and the line `include /etc/firejail/disable-interpreters.inc` in firefox-common.profile and chromium-common.profile the problem goes away. The above change also solved a problem I've been having recently (perhaps after an update), where my default browser, Firefox, kept warning it wasn't set as default, every single time I started it. BTW, no `private-bin` is active anywhere in the profile files.

gitea-mirror commented

2026-05-05 07:55:55 -06:00

Author

Owner

@ghost commented on GitHub (Jul 7, 2018):

Ok, so the offending code is the python3 block in disable-interpreters.inc (which makes sense because chome-gnome-shell uses python3), plus nodbus.

This problem is probably common to all Gnome users, but I guess users should decide whether take the risk and manually disable the extra protections provided by firejail. Feel free to close this issue if you agree.

@ghost commented on GitHub (Jul 7, 2018): Ok, so the offending code is the python3 block in `disable-interpreters.inc` (which makes sense because chome-gnome-shell uses python3), plus `nodbus`. This problem is probably common to all Gnome users, but I guess users should decide whether take the risk and manually disable the extra protections provided by firejail. Feel free to close this issue if you agree.

gitea-mirror commented

2026-05-05 07:55:58 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 8, 2018):

Hmmm, maybe we can leave a note in the profile so that affected users will know what to do?

@chiraag-nataraj commented on GitHub (Jul 8, 2018): Hmmm, maybe we can leave a note in the profile so that affected users will know what to do?

gitea-mirror commented

2026-05-05 07:56:02 -06:00

Author

Owner

@ghost commented on GitHub (Jul 11, 2018):

Seems reasonable to me.

@ghost commented on GitHub (Jul 11, 2018): Seems reasonable to me.

gitea-mirror commented

2026-05-05 07:56:03 -06:00

Author

Owner

@ghost commented on GitHub (Jul 21, 2018):

Since Firefox supports multiple user profiles, I was wondering if there is a way to make firejail use a different .profile file somehow, perhaps depending on command line parameters or something else?

That way one could have a secure browser instance for everyday use, and a "less secure" one for exceptions like gnome.

@ghost commented on GitHub (Jul 21, 2018): Since Firefox supports [multiple user profiles](https://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-firefox-profiles), I was wondering if there is a way to make firejail use a different .profile file somehow, perhaps depending on command line parameters or something else? That way one could have a secure browser instance for everyday use, and a "less secure" one for exceptions like gnome.

gitea-mirror commented

2026-05-05 07:56:06 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 21, 2018):

I would just set up scripts for that. You can use --profile= to tell firejail to use a specific profile file. If you created two profile files, one blacklisting dbus and python3 (say, firefox.profile) and without those blacklists (firefox-insecure.profile), then you could use firejail firefox as your regular command and firejail --profile=~/.config/firejail/firefox-insecure.profile firefox as your insecure version.

@chiraag-nataraj commented on GitHub (Jul 21, 2018): I would just set up scripts for that. You can use `--profile=` to tell `firejail` to use a specific profile file. If you created two profile files, one blacklisting `dbus` and `python3` (say, `firefox.profile`) and without those blacklists (`firefox-insecure.profile`), then you could use `firejail firefox` as your regular command and `firejail --profile=~/.config/firejail/firefox-insecure.profile firefox` as your insecure version.

gitea-mirror commented

2026-05-05 07:56:08 -06:00

Author

Owner

@ghost commented on GitHub (Jul 22, 2018):

Much simpler than I though. Thank you.

@ghost commented on GitHub (Jul 22, 2018): Much simpler than I though. Thank you.

gitea-mirror commented

2026-05-05 07:56:10 -06:00

Author

Owner

@RedAtRareCandy commented on GitHub (Nov 19, 2018):

Hi all,

Thanks for the pointers on how to work-around this so Gnome Extensions works again.

I followed the firefox-insecure.profile suggestion (modified copy of firefox.profile), but found that the nodbus line was in the firefox-common.profile so rather than duplicate that too or edit it, I used ignore in my new profile instead. Had to add a few extra python3 noblacklist lines in as well. I'm not very familiar with correct practice of when to use ignore so hopefully this was acceptable and was the best approach :)

firefox-insecure.txt

@RedAtRareCandy commented on GitHub (Nov 19, 2018): Hi all, Thanks for the pointers on how to work-around this so Gnome Extensions works again. I followed the firefox-insecure.profile suggestion (modified copy of firefox.profile), but found that the nodbus line was in the firefox-common.profile so rather than duplicate that too or edit it, I used ignore in my new profile instead. Had to add a few extra python3 noblacklist lines in as well. I'm not very familiar with correct practice of when to use ignore so hopefully this was acceptable and was the best approach :) [firefox-insecure.txt](https://github.com/netblue30/firejail/files/2593575/firefox-insecure.txt)

gitea-mirror referenced this issue

2026-05-05 10:10:33 -06:00

[PR #1365] [MERGED] Harden 50 profiles #3928

Rows
Columns

[GH-ISSUE #2026] Firejail breaks Gnome Shell connector #1365