[GH-ISSUE #2066] Tor Browser cannot execute with "noroot" and "nogroups" profile #1395

Closed
opened 2026-05-05 08:03:04 -06:00 by gitea-mirror · 33 comments
Owner

Originally created by @Joonho365Han on GitHub (Jul 25, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2066

Originally assigned to: @chiraag-nataraj on GitHub.

Recreating the issue:

  • System: Arch Linux (no apparmor, no SELinux, no other sandboxing apps)
  • Firejail Version: 0.9.54-1
  • Tor Browser Version: 7.5.6-1
  • Execute: /usr/bin/firejail --profile=/etc/firejail/tor-browser-en.profile /usr/bin/tor-browser-en
    OR depending on the distro
    /usr/bin/firejail --profile=/etc/firejail/tor-browser-en.profile /usr/bin/${YOUR_EXECUTABLE}
  • Result: child process will exit without any warning or error messages:

Reading profile /etc/firejail/tor-browser-en.profile
Reading profile /etc/firejail/torbrowser-launcher.profile
Reading profile /etc/firejail/torbrowser-launcher.local
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 31605, child pid 31606
Warning: skipping pki for private /etc
Warning: skipping crypto-policies for private /etc
Warning: skipping alsa for private /etc
Private /etc installed in 31.82 ms
97 programs installed in 61.01 ms
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: cleaning all supplementary groups
Blacklist violations are logged to syslog
Child process initialized in 141.65 ms

Parent is shutting down, bye...

My torbrowser-launcher.local:

#,Firejail,profile,for,torbrowser-launcher

whitelist ${HOME}/.tor-browser-en
whitelist ${HOME}/Downloads
whitelist ${HOME}/.uim.d

private-bin /usr/bin/tor-browser-en
private-etc machine-id,passwd

My exec command:

/usr/bin/firejail --profile=/etc/firejail/tor-browser-en.profile /usr/bin/tor-browser-en

Considering this happened when I updated Firejail and not Tor Browser, I assume it has something to do with how Firejail changed implementation of "nogroups" and "noroot."

Originally created by @Joonho365Han on GitHub (Jul 25, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2066 Originally assigned to: @chiraag-nataraj on GitHub. Recreating the issue: - System: Arch Linux (no apparmor, no SELinux, no other sandboxing apps) - Firejail Version: 0.9.54-1 - Tor Browser Version: 7.5.6-1 - Execute: /usr/bin/firejail --profile=/etc/firejail/tor-browser-en.profile /usr/bin/tor-browser-en OR depending on the distro /usr/bin/firejail --profile=/etc/firejail/tor-browser-en.profile /usr/bin/${YOUR_EXECUTABLE} - Result: child process will exit without any warning or error messages: >Reading profile /etc/firejail/tor-browser-en.profile >Reading profile /etc/firejail/torbrowser-launcher.profile >Reading profile /etc/firejail/torbrowser-launcher.local >Reading profile /etc/firejail/disable-common.inc >Reading profile /etc/firejail/disable-devel.inc >Reading profile /etc/firejail/disable-interpreters.inc >Reading profile /etc/firejail/disable-passwdmgr.inc >Reading profile /etc/firejail/disable-programs.inc >Reading profile /etc/firejail/whitelist-common.inc >Reading profile /etc/firejail/whitelist-var-common.inc >Parent pid 31605, child pid 31606 >Warning: skipping pki for private /etc >Warning: skipping crypto-policies for private /etc >Warning: skipping alsa for private /etc >Private /etc installed in 31.82 ms >97 programs installed in 61.01 ms >Warning: cleaning all supplementary groups >Warning: cleaning all supplementary groups >Warning: /sbin directory link was not blacklisted >Warning: /usr/sbin directory link was not blacklisted >Warning: cleaning all supplementary groups >Blacklist violations are logged to syslog >Child process initialized in 141.65 ms > >Parent is shutting down, bye... My torbrowser-launcher.local: >#,Firejail,profile,for,torbrowser-launcher > >whitelist ${HOME}/.tor-browser-en >whitelist ${HOME}/Downloads >whitelist ${HOME}/.uim.d > >private-bin /usr/bin/tor-browser-en >private-etc machine-id,passwd My exec command: >/usr/bin/firejail --profile=/etc/firejail/tor-browser-en.profile /usr/bin/tor-browser-en Considering this happened when I updated Firejail and not Tor Browser, I assume it has something to do with how Firejail changed implementation of "nogroups" and "noroot."
Author
Owner

@chiraag-nataraj commented on GitHub (Jul 25, 2018):

I will investigate this and report back.

<!-- gh-comment-id:407719206 --> @chiraag-nataraj commented on GitHub (Jul 25, 2018): I will investigate this and report back.
Author
Owner

@chiraag-nataraj commented on GitHub (Jul 25, 2018):

Which version did you upgrade from? That way, I can do a git bisect to find the offending commit.

<!-- gh-comment-id:407719297 --> @chiraag-nataraj commented on GitHub (Jul 25, 2018): Which version did you upgrade from? That way, I can do a `git bisect` to find the offending commit.
Author
Owner

@Joonho365Han commented on GitHub (Jul 25, 2018):

It was upgraded from 0.9.52-1.

<!-- gh-comment-id:407720416 --> @Joonho365Han commented on GitHub (Jul 25, 2018): It was upgraded from 0.9.52-1.
Author
Owner

@chiraag-nataraj commented on GitHub (Jul 25, 2018):

Okay, thanks.

<!-- gh-comment-id:407720484 --> @chiraag-nataraj commented on GitHub (Jul 25, 2018): Okay, thanks.
Author
Owner

@SkewedZeppelin commented on GitHub (Jul 25, 2018):

@Joonho365Han are you using the proprietary NVIDIA driver?

<!-- gh-comment-id:407806321 --> @SkewedZeppelin commented on GitHub (Jul 25, 2018): @Joonho365Han are you using the proprietary NVIDIA driver?
Author
Owner

@Joonho365Han commented on GitHub (Jul 25, 2018):

@SkewedZeppelin No I'm using Intel HD Graphics 520

<!-- gh-comment-id:407845176 --> @Joonho365Han commented on GitHub (Jul 25, 2018): @SkewedZeppelin No I'm using Intel HD Graphics 520
Author
Owner

@chiraag-nataraj commented on GitHub (Jul 25, 2018):

It's most likely apparmor. Do you have an apparmor profile for torbrowser?

<!-- gh-comment-id:407862266 --> @chiraag-nataraj commented on GitHub (Jul 25, 2018): It's most likely apparmor. Do you have an apparmor profile for torbrowser?
Author
Owner

@Joonho365Han commented on GitHub (Jul 25, 2018):

No. I do not use a custom local profile for Tor browser and the profile that came with firejail in this version does not enable apparmor.

<!-- gh-comment-id:407878146 --> @Joonho365Han commented on GitHub (Jul 25, 2018): No. I do not use a custom local profile for Tor browser and the profile that came with firejail in this version does not enable apparmor.
Author
Owner

@chiraag-nataraj commented on GitHub (Jul 25, 2018):

I'm not talking about the apparmor option in firejail, which turns on firejail's apparmor profile. I'm talking about a profile for the tor browser that might have been shipped with the tor browser. Even if you don't turn on apparmor in firejail, if there's a matching profile that's been enabled (and some distros enable apparmor profiles by default), then that will still cause problems. One way you can see this is by looking in the system log (e.g. journalctl) to see if you get apparmor messages.

<!-- gh-comment-id:407892524 --> @chiraag-nataraj commented on GitHub (Jul 25, 2018): I'm not talking about the `apparmor` option in `firejail`, which turns on _firejail_'s apparmor profile. I'm talking about a profile for the tor browser that might have been shipped with the tor browser. Even if you don't turn on `apparmor` in `firejail`, if there's a matching profile that's been enabled (and some distros enable apparmor profiles by default), then that will still cause problems. One way you can see this is by looking in the system log (e.g. `journalctl`) to see if you get apparmor messages.
Author
Owner

@Joonho365Han commented on GitHub (Jul 26, 2018):

I believe only the TBB (Tor browser bundle) in Tails has AppArmor enabled by default. It also shouldn't be since Apparmor requires kernel modules and parameters to load and I do not have them enabled.

<!-- gh-comment-id:407988337 --> @Joonho365Han commented on GitHub (Jul 26, 2018): I believe only the TBB (Tor browser bundle) in Tails has AppArmor enabled by default. It also shouldn't be since Apparmor requires kernel modules and parameters to load and I do not have them enabled.
Author
Owner

@chiraag-nataraj commented on GitHub (Jul 26, 2018):

Okay. Because on Debian, AppArmor was preventing Firejail from working correctly, and disabling the torbrowser-launcher (and associated) apparmor profiles allowed me to load torbrowser-launcher with noroot and nogroups enabled. If you don't have apparmor enabled (and I really would double-check that it's not enabled), I'm not sure what's going on here.

<!-- gh-comment-id:408052066 --> @chiraag-nataraj commented on GitHub (Jul 26, 2018): Okay. Because on Debian, AppArmor was preventing Firejail from working correctly, and disabling the torbrowser-launcher (and associated) apparmor profiles allowed me to load torbrowser-launcher with `noroot` and `nogroups` enabled. If you don't have apparmor enabled (and I really would double-check that it's not enabled), I'm not sure what's going on here.
Author
Owner

@Vincent43 commented on GitHub (Jul 26, 2018):

@Joonho365Han you didn't write what system you use. AppArmor is enabled by default in Ubuntu, Debian (testing, unstable), and openSUSE.

BTW: If you have AppArmor profile for your app it's possibly better to disable firejail rather than AppArmor.

<!-- gh-comment-id:408097695 --> @Vincent43 commented on GitHub (Jul 26, 2018): @Joonho365Han you didn't write what system you use. AppArmor is enabled by default in Ubuntu, Debian (testing, unstable), and openSUSE. BTW: If you have AppArmor profile for your app it's possibly better to disable firejail rather than AppArmor.
Author
Owner

@Joonho365Han commented on GitHub (Jul 26, 2018):

@Vincent43 Right. I realized it was necessary after chiraag just mentioned it. I'm using Arch and I don't have any MAC like Apparmor or SELinux installed that messes with blacklist/whitelist permissions.

<!-- gh-comment-id:408183489 --> @Joonho365Han commented on GitHub (Jul 26, 2018): @Vincent43 Right. I realized it was necessary after chiraag just mentioned it. I'm using Arch and I don't have any MAC like Apparmor or SELinux installed that messes with blacklist/whitelist permissions.
Author
Owner

@chiraag-nataraj commented on GitHub (Jul 26, 2018):

@Joonho365Han Huh, that's really weird then. Do you get anything showing up in your audit logs?

<!-- gh-comment-id:408213416 --> @chiraag-nataraj commented on GitHub (Jul 26, 2018): @Joonho365Han Huh, that's really weird then. Do you get anything showing up in your audit logs?
Author
Owner

@Joonho365Han commented on GitHub (Jul 26, 2018):

@chiraag-nataraj No. Nothing even on system journal.

<!-- gh-comment-id:408227075 --> @Joonho365Han commented on GitHub (Jul 26, 2018): @chiraag-nataraj No. Nothing even on system journal.
Author
Owner

@Vincent43 commented on GitHub (Jul 26, 2018):

You can try installing latest firejail snapshot from AUR: https://aur.archlinux.org/packages/firejail-git/

<!-- gh-comment-id:408240686 --> @Vincent43 commented on GitHub (Jul 26, 2018): You can try installing latest firejail snapshot from AUR: https://aur.archlinux.org/packages/firejail-git/
Author
Owner

@Joonho365Han commented on GitHub (Jul 27, 2018):

@Vincent43 That's actually not the official firejail package for Arch and it's not maintained since 2017. The official one I'm using is https://www.archlinux.org/packages/community/x86_64/firejail/ and it's up to date with the repo.

<!-- gh-comment-id:408301814 --> @Joonho365Han commented on GitHub (Jul 27, 2018): @Vincent43 That's actually not the official firejail package for Arch and it's not maintained since 2017. The official one I'm using is https://www.archlinux.org/packages/community/x86_64/firejail/ and it's up to date with the repo.
Author
Owner

@chiraag-nataraj commented on GitHub (Jul 27, 2018):

@Joonho365Han Can you try building from the latest git version?

<!-- gh-comment-id:408379116 --> @chiraag-nataraj commented on GitHub (Jul 27, 2018): @Joonho365Han Can you try building from the latest git version?
Author
Owner

@Vincent43 commented on GitHub (Jul 27, 2018):

If you are new to Archlinux please read: https://wiki.archlinux.org/index.php/Arch_User_Repository

The package I linked will install the latest git version form github which is 157 commits ahead of what you currently use. For *-git packages the "Last Updated" date doesn't matter as they automatically fetch new commits from git.

<!-- gh-comment-id:408408376 --> @Vincent43 commented on GitHub (Jul 27, 2018): If you are new to Archlinux please read: https://wiki.archlinux.org/index.php/Arch_User_Repository The package I linked will install the latest git version form github which is [157 commits ahead](https://github.com/netblue30/firejail/releases/tag/0.9.54) of what you currently use. For `*-git` packages the "Last Updated" date doesn't matter as they automatically fetch new commits from git.
Author
Owner

@Joonho365Han commented on GitHub (Jul 27, 2018):

@Vincent43 Really? Good to know. I just tried it with the package you linked but it's still producing the same issue.

<!-- gh-comment-id:408550865 --> @Joonho365Han commented on GitHub (Jul 27, 2018): @Vincent43 Really? Good to know. I just tried it with the package you linked but it's still producing the same issue.
Author
Owner

@chiraag-nataraj commented on GitHub (Jul 30, 2018):

So nothing shows up in your logs and yet this fails to start. Okay, I have an Arch VM. I'll try to see if I can figure something out.

<!-- gh-comment-id:408882794 --> @chiraag-nataraj commented on GitHub (Jul 30, 2018): So nothing shows up in your logs and yet this fails to start. Okay, I have an Arch VM. I'll try to see if I can figure something out.
Author
Owner

@chiraag-nataraj commented on GitHub (Aug 6, 2018):

@Joonho365Han How did you install the tor browser bundle?

<!-- gh-comment-id:410710638 --> @chiraag-nataraj commented on GitHub (Aug 6, 2018): @Joonho365Han How did you install the tor browser bundle?
Author
Owner

@Joonho365Han commented on GitHub (Aug 8, 2018):

Via the AUR.

<!-- gh-comment-id:411275152 --> @Joonho365Han commented on GitHub (Aug 8, 2018): Via the AUR.
Author
Owner

@Fred-Barclay commented on GitHub (Aug 11, 2018):

@Joonho365Han Can you post the commands and terminal output of however you start the TBB inside firejail?
I'm on Arch, and using TBB from the tor website (not the AUR) and using firejail --profile=/etc/firejail/start-tor-browser.profile ./start-tor-browser.desktop works fine for me.

Cheers!

<!-- gh-comment-id:412279862 --> @Fred-Barclay commented on GitHub (Aug 11, 2018): @Joonho365Han Can you post the commands and terminal output of however you start the TBB inside firejail? I'm on Arch, and using TBB from the tor website (not the AUR) and using `firejail --profile=/etc/firejail/start-tor-browser.profile ./start-tor-browser.desktop` works fine for me. Cheers!
Author
Owner

@Joonho365Han commented on GitHub (Aug 12, 2018):

@Fred-Barclay I've updated the post with the requested info.

<!-- gh-comment-id:412310628 --> @Joonho365Han commented on GitHub (Aug 12, 2018): @Fred-Barclay I've updated the post with the requested info.
Author
Owner

@chiraag-nataraj commented on GitHub (Aug 14, 2018):

@Joonho365Han The profile installed with firejail (from AUR) works fine in my archlinux VM with the tor-browser-en from AUR.

<!-- gh-comment-id:412861836 --> @chiraag-nataraj commented on GitHub (Aug 14, 2018): @Joonho365Han The profile installed with firejail (from AUR) works fine in my archlinux VM with the tor-browser-en from AUR.
Author
Owner

@chiraag-nataraj commented on GitHub (Aug 16, 2018):

@Joonho365Han Have you changed any defaults (with respect to "vanilla" Arch) that might be affecting this?

<!-- gh-comment-id:413567419 --> @chiraag-nataraj commented on GitHub (Aug 16, 2018): @Joonho365Han Have you changed any defaults (with respect to "vanilla" Arch) that might be affecting this?
Author
Owner

@Joonho365Han commented on GitHub (Aug 17, 2018):

@chiraag-nataraj What do you mean by defaults?

<!-- gh-comment-id:413726648 --> @Joonho365Han commented on GitHub (Aug 17, 2018): @chiraag-nataraj What do you mean by defaults?
Author
Owner

@chiraag-nataraj commented on GitHub (Aug 17, 2018):

@Joonho365Han I'm not really sure, since I only set up an Arch VM to test this (I don't use it on a daily basis). I guess what I mean is do you think anything else about your setup is relevant? Because based on the info you've given us, I was unable to reproduce the issue on my Arch VM.

<!-- gh-comment-id:413830068 --> @chiraag-nataraj commented on GitHub (Aug 17, 2018): @Joonho365Han I'm not really sure, since I only set up an Arch VM to test this (I don't use it on a daily basis). I guess what I mean is do you think anything else about your setup is relevant? Because based on the info you've given us, I was unable to reproduce the issue on my Arch VM.
Author
Owner

@Joonho365Han commented on GitHub (Aug 17, 2018):

@chiraag-nataraj Not sure... Does firejail create a custom user to execute in the sandbox?

<!-- gh-comment-id:414006127 --> @Joonho365Han commented on GitHub (Aug 17, 2018): @chiraag-nataraj Not sure... Does firejail create a custom user to execute in the sandbox?
Author
Owner

@chiraag-nataraj commented on GitHub (Aug 17, 2018):

@Joonho365Han Nope, at least not by default.

<!-- gh-comment-id:414006239 --> @chiraag-nataraj commented on GitHub (Aug 17, 2018): @Joonho365Han Nope, at least not by default.
Author
Owner

@ghost commented on GitHub (Feb 20, 2019):

Anyone solved this little problem? =)
I get 4 Warning: cleaning all supplementary groups when running firefox. The warnings disappear when I comment out 'noroot' from the firejail-common.profille. I have both stopped and disabled apparmor just to see so that it wasnt it creating these.
PS i have arch linux hardened kernel

<!-- gh-comment-id:465566406 --> @ghost commented on GitHub (Feb 20, 2019): Anyone solved this little problem? =) I get 4 Warning: cleaning all supplementary groups when running firefox. The warnings disappear when I comment out 'noroot' from the firejail-common.profille. I have both stopped and disabled apparmor just to see so that it wasnt it creating these. PS i have arch linux hardened kernel
Author
Owner

@Joonho365Han commented on GitHub (Mar 2, 2019):

@anteg So I don't remember exactly when but I updated my entire system, which resolved the issue. I don't remember what version it started to work again. Try out the latest one?

<!-- gh-comment-id:468966418 --> @Joonho365Han commented on GitHub (Mar 2, 2019): @anteg So I don't remember exactly when but I updated my entire system, which resolved the issue. I don't remember what version it started to work again. Try out the latest one?
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1395
No description provided.