github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2101] Firejail breaks evince printing #1421

New issue

Closed

opened 2026-05-05 08:05:14 -06:00 by gitea-mirror · 7 comments

gitea-mirror commented

2026-05-05 08:05:14 -06:00

Owner

Originally created by @matu3ba on GitHub (Aug 30, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2101

Ubuntu 18.04.1 LTS
firejail version 0.9.56~rc1
GNOME-Dokumentenbetrachter 3.28.2

firejail --noprofile evince does not work as well,
but sudo firecfg --clean makes evince possible to print again.

To that regard uncommenting nodbus makes no difference (for me).
From the issue #1843 or commit 7a37dc31ab only
-# blacklist /run/user/*/bus was removed and
+# nodbus added.
Did anybody have issues or can reason about why dbus was not removed in the first place?

Originally created by @matu3ba on GitHub (Aug 30, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2101 Ubuntu 18.04.1 LTS firejail version 0.9.56~rc1 GNOME-Dokumentenbetrachter 3.28.2 `firejail --noprofile evince` does not work as well, but `sudo firecfg --clean` makes evince possible to print again. To that regard uncommenting `nodbus` makes no difference (for me). From the issue #1843 or commit 7a37dc31ab907d55eb88f2fa259f37046952a0c5 only `-# blacklist /run/user/*/bus` was removed and `+# nodbus` added. Did anybody have issues or can reason about why dbus was not removed in the first place?

gitea-mirror closed this issue

2026-05-05 08:05:15 -06:00

gitea-mirror commented

2026-05-05 08:05:16 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Aug 30, 2018):

Can you clarify?
Can you run each of the following and confirm whether you can print on not?

firejail /usr/bin/evince
firejail --noprofile /usr/bin/evince
sudo firecfg && sudo -k && evince

@SkewedZeppelin commented on GitHub (Aug 30, 2018): Can you clarify? Can you run each of the following and confirm whether you can print on not? ``` firejail /usr/bin/evince firejail --noprofile /usr/bin/evince sudo firecfg && sudo -k && evince ```

gitea-mirror commented

2026-05-05 08:05:18 -06:00

Author

Owner

@matu3ba commented on GitHub (Aug 30, 2018):

The printing dialog opens, however no installed and connected printer device is found.
Running neither of the commands did show up the according printer device.

In comparison okular works like expected.

@matu3ba commented on GitHub (Aug 30, 2018): The printing dialog opens, however no installed and connected printer device is found. Running neither of the commands did show up the according printer device. In comparison okular works like expected.

gitea-mirror commented

2026-05-05 08:05:19 -06:00

Author

Owner

@matu3ba commented on GitHub (Aug 30, 2018):

Do the following messages help? They occur in each of the commands [and # nodbus is used], so dbus use should work.
GLib-GIO-CRITICAL **: 23:49:32.556: g_dbus_proxy_new_sync: assertion G_IS_DBUS_CONNECTION (connection)' failed
** (evince:161): WARNING **: Connection failed: No authorization
** (evince:161): WARNING **: Couldn't connect to D-Bus system bus, Connection failed: No authorization

@matu3ba commented on GitHub (Aug 30, 2018): Do the following messages help? They occur in each of the commands [and `# nodbus` is used], so dbus use should work. GLib-GIO-CRITICAL **: 23:49:32.556: g_dbus_proxy_new_sync: assertion G_IS_DBUS_CONNECTION (connection)' failed ** (evince:161): WARNING **: Connection failed: No authorization ** (evince:161): WARNING **: Couldn't connect to D-Bus system bus, Connection failed: No authorization

gitea-mirror commented

2026-05-05 08:05:19 -06:00

Author

Owner

@Vincent43 commented on GitHub (Aug 31, 2018):

Is evince confined by AppArmor? You may check with sudo aa-status.

@Vincent43 commented on GitHub (Aug 31, 2018): Is evince confined by AppArmor? You may check with `sudo aa-status`.

gitea-mirror commented

2026-05-05 08:05:20 -06:00

Author

Owner

@matu3ba commented on GitHub (Sep 1, 2018):

sudo aa-status
apparmor module is loaded.
25 profiles are loaded.
23 profiles are in enforce mode.
/sbin/dhclient
/usr/bin/evince
/usr/bin/evince-previewer
/usr/bin/evince-previewer//sanitized_helper
/usr/bin/evince-thumbnailer
/usr/bin/evince-thumbnailer//sanitized_helper
/usr/bin/evince//sanitized_helper
/usr/bin/man
/usr/lib/NetworkManager/nm-dhcp-client.action
/usr/lib/NetworkManager/nm-dhcp-helper
/usr/lib/connman/scripts/dhclient-script
/usr/lib/cups/backend/cups-pdf
/usr/lib/lightdm/lightdm-guest-session
/usr/lib/lightdm/lightdm-guest-session//chromium
/usr/sbin/cupsd
/usr/sbin/cupsd//third_party
/usr/sbin/tcpdump
libreoffice-senddoc
libreoffice-senddoc//sanitized_helper
libreoffice-soffice//gpg
libreoffice-xpdfimport
man_filter
man_groff
2 profiles are in complain mode.
libreoffice-oopslash
libreoffice-soffice
2 processes have profiles defined.
2 processes are in enforce mode.
/sbin/dhclient (962)
/usr/sbin/cupsd (2634)
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
Yes, it is. How do I fix this? Is this not tested during call of firecfg ?

@matu3ba commented on GitHub (Sep 1, 2018): `sudo aa-status` apparmor module is loaded. 25 profiles are loaded. 23 profiles are in enforce mode. /sbin/dhclient /usr/bin/evince /usr/bin/evince-previewer /usr/bin/evince-previewer//sanitized_helper /usr/bin/evince-thumbnailer /usr/bin/evince-thumbnailer//sanitized_helper /usr/bin/evince//sanitized_helper /usr/bin/man /usr/lib/NetworkManager/nm-dhcp-client.action /usr/lib/NetworkManager/nm-dhcp-helper /usr/lib/connman/scripts/dhclient-script /usr/lib/cups/backend/cups-pdf /usr/lib/lightdm/lightdm-guest-session /usr/lib/lightdm/lightdm-guest-session//chromium /usr/sbin/cupsd /usr/sbin/cupsd//third_party /usr/sbin/tcpdump libreoffice-senddoc libreoffice-senddoc//sanitized_helper libreoffice-soffice//gpg libreoffice-xpdfimport man_filter man_groff 2 profiles are in complain mode. libreoffice-oopslash libreoffice-soffice 2 processes have profiles defined. 2 processes are in enforce mode. /sbin/dhclient (962) /usr/sbin/cupsd (2634) 0 processes are in complain mode. 0 processes are unconfined but have a profile defined. Yes, it is. How do I fix this? Is this not tested during call of `firecfg` ?

gitea-mirror commented

2026-05-05 08:05:21 -06:00

Author

Owner

@Vincent43 commented on GitHub (Sep 1, 2018):

The only thing firecfg does is making symlink from evince to firejail. You have to decide if you prefer using AppAmor or firejail to sandbox evince and disable the other one.

@Vincent43 commented on GitHub (Sep 1, 2018): The only thing `firecfg` does is making symlink from evince to firejail. You have to decide if you prefer using AppAmor or firejail to sandbox evince and disable the other one.

gitea-mirror commented

2026-05-05 08:05:22 -06:00

Author

Owner

@matu3ba commented on GitHub (Sep 1, 2018):

@Vincent43 Thanks alot.
Curiously evince with printing also works with the option nodbus enabled (so dbus disabled).

@matu3ba commented on GitHub (Sep 1, 2018): @Vincent43 Thanks alot. Curiously evince with printing also works with the option `nodbus` enabled (so dbus disabled).

gitea-mirror referenced this issue

2026-05-05 10:11:03 -06:00

[PR #1421] [MERGED] Fix #1420 #3954

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1421

No description provided.

Rows
Columns