[GH-ISSUE #2121] man-pages not readable while less firejailed and man app-armored

gitea-mirror commented

2026-05-05 08:06:15 -06:00

Owner

Originally created by @btittelbach on GitHub (Sep 24, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2121

%  man less
Error clone: main.c:2517 main: Operation not permitted
man: command exited with status 1: sed -e '/^[[:space:]]*$/{ N; /^[[:space:]]*\n[[:space:]]*$/D; }' | LESS=-ix8RmPm Manual page less(1) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$PM Manual page less(1) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$ MAN_PN=less(1) less
% man firejail                                                                                                                                                    :(
Error clone: main.c:2517 main: Operation not permitted
man: command exited with status 1: sed -e '/^[[:space:]]*$/{ N; /^[[:space:]]*\n[[:space:]]*$/D; }' | LESS=-ix8RmPm Manual page firejail(1) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$PM Manual page firejail(1) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$ MAN_PN=firejail(1) less
% sudo rm /usr/local/bin/less
% man firejail
..... works ......

Bug: firejailed less ist not allowed to preprocess / display man-pages. Thus man does not work.

Distro: Ubuntu 18.04
Firejail Version: 0.9.52

Possible Workarounds:

do not firejail less
export PAGER=most

Originally created by @btittelbach on GitHub (Sep 24, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2121 ``` zsh % man less Error clone: main.c:2517 main: Operation not permitted man: command exited with status 1: sed -e '/^[[:space:]]*$/{ N; /^[[:space:]]*\n[[:space:]]*$/D; }' | LESS=-ix8RmPm Manual page less(1) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$PM Manual page less(1) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$ MAN_PN=less(1) less % man firejail :( Error clone: main.c:2517 main: Operation not permitted man: command exited with status 1: sed -e '/^[[:space:]]*$/{ N; /^[[:space:]]*\n[[:space:]]*$/D; }' | LESS=-ix8RmPm Manual page firejail(1) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$PM Manual page firejail(1) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$ MAN_PN=firejail(1) less % sudo rm /usr/local/bin/less % man firejail ..... works ...... ``` **Bug**: firejailed less ist not allowed to preprocess / display man-pages. Thus `man` does not work. **Distro**: Ubuntu 18.04 **Firejail Version**: 0.9.52 Possible Workarounds: * do not firejail less * `export PAGER=most`

gitea-mirror

2026-05-05 08:06:15 -06:00

closed this issue
added the
information_old

workaround
labels

gitea-mirror commented

2026-05-05 08:06:19 -06:00

Author

Owner

@btittelbach commented on GitHub (Sep 24, 2018):

% cat /etc/firejail/less.profile 
# Firejail profile for less
# This file is overwritten after every install/update
quiet
# Persistent local customizations
include /etc/firejail/less.local
# Persistent global definitions
include /etc/firejail/globals.local

blacklist /run/user/*/bus
blacklist /tmp/.X11-unix

ignore noroot
net none
no3d
nodvd
nosound
notv
novideo
shell none
tracelog
writable-var-log

# The user can have a custom coloring scritps configured in ${HOME}/.lessfilter.
# Enable private-bin and private-lib if you are not using any filter.
# private-bin less
# private-lib
private-dev

memory-deny-write-execute
noexec ${HOME}
noexec /tmp

include /etc/firejail/default.profile

@btittelbach commented on GitHub (Sep 24, 2018): ``` % cat /etc/firejail/less.profile # Firejail profile for less # This file is overwritten after every install/update quiet # Persistent local customizations include /etc/firejail/less.local # Persistent global definitions include /etc/firejail/globals.local blacklist /run/user/*/bus blacklist /tmp/.X11-unix ignore noroot net none no3d nodvd nosound notv novideo shell none tracelog writable-var-log # The user can have a custom coloring scritps configured in ${HOME}/.lessfilter. # Enable private-bin and private-lib if you are not using any filter. # private-bin less # private-lib private-dev memory-deny-write-execute noexec ${HOME} noexec /tmp include /etc/firejail/default.profile ```

gitea-mirror commented

2026-05-05 08:06:20 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Sep 25, 2018):

How exactly are you doing this? On Debian, man uses /usr/bin/pager by default, which is a link to /etc/alternatives/pager. If I create a pager profile and symlink it (/usr/local/bin/pager -> /usr/local/bin/firejail), firejail throws up a warning about an existing sandbox being detected. I can't quite figure out how that's happening though.

@chiraag-nataraj commented on GitHub (Sep 25, 2018): How exactly are you doing this? On Debian, `man` uses `/usr/bin/pager` by default, which is a link to `/etc/alternatives/pager`. If I create a `pager` profile and symlink it (`/usr/local/bin/pager -> /usr/local/bin/firejail`), `firejail` throws up a warning about an existing sandbox being detected. I can't quite figure out how that's happening though.

gitea-mirror commented

2026-05-05 08:06:21 -06:00

Author

Owner

@Vincent43 commented on GitHub (Sep 25, 2018):

IIRC man is confined by default with AppArmor in Ubuntu. Can you check it with sudo aa-status |grep man?

Also journalctl |grep DENIED

@Vincent43 commented on GitHub (Sep 25, 2018): IIRC man is confined by default with AppArmor in Ubuntu. Can you check it with `sudo aa-status |grep man`? Also `journalctl |grep DENIED`

gitea-mirror commented

2026-05-05 08:06:21 -06:00

Author

Owner

@btittelbach commented on GitHub (Sep 30, 2018):

journalctl |grep DENIED:

Sep 30 13:35:20 host.domain.cc audit[5119]: AVC apparmor="DENIED" operation="ptrace" profile="/usr/bin/man" pid=5119 comm="firejail" requested_mask="trace" denied_mask="trace" peer="unconfined"
Sep 30 13:35:20 host.domain.cc kernel: audit: type=1400 audit(1538307320.383:40): apparmor="DENIED" operation="ptrace" profile="/usr/bin/man" pid=5119 comm="firejail" requested_mask="trace" denied_mask="trace" peer="unconfined"

sudo aa-status | grep man:

   /usr/bin/man
   /usr/lib/connman/scripts/dhclient-script
   man_filter
   man_groff

@btittelbach commented on GitHub (Sep 30, 2018): **`journalctl |grep DENIED`:** ``` Sep 30 13:35:20 host.domain.cc audit[5119]: AVC apparmor="DENIED" operation="ptrace" profile="/usr/bin/man" pid=5119 comm="firejail" requested_mask="trace" denied_mask="trace" peer="unconfined" Sep 30 13:35:20 host.domain.cc kernel: audit: type=1400 audit(1538307320.383:40): apparmor="DENIED" operation="ptrace" profile="/usr/bin/man" pid=5119 comm="firejail" requested_mask="trace" denied_mask="trace" peer="unconfined" ``` **`sudo aa-status | grep man`:** ``` /usr/bin/man /usr/lib/connman/scripts/dhclient-script man_filter man_groff ```

gitea-mirror commented

2026-05-05 08:06:21 -06:00

Author

Owner

@Vincent43 commented on GitHub (Sep 30, 2018):

You mat try to disable AppArmor man profile with sudo aa-disable /usr/bin/man then reboot and see if this helps. You can undo this with sudo aa-enforce /usr/bin/man.

@Vincent43 commented on GitHub (Sep 30, 2018): You mat try to disable AppArmor man profile with `sudo aa-disable /usr/bin/man` then reboot and see if this helps. You can undo this with `sudo aa-enforce /usr/bin/man`.

gitea-mirror commented

2026-05-05 08:06:22 -06:00

Author

Owner

@btittelbach commented on GitHub (Oct 1, 2018):

It works as expected even without rebooting.

% export PAGER=/usr/local/bin/less
% sudo aa-disable /usr/bin/man
Disabling /usr/bin/man.
% man test
% sudo aa-enforce /usr/bin/man                                                                                                                           Setting /usr/bin/man to enforce mode.
% man test
Error clone: main.c:2517 main: Operation not permitted
man: command exited with status 1: sed -e '/^[[:space:]]*$/{ N; /^[[:space:]]*\n[[:space:]]*$/D; }' | LESS=-ix8RmPm Manual page test(1) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$PM Manual page test(1) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$ MAN_PN=test(1) /usr/local/bin/less

So we know the double-sandboxing in Ubuntu of AppArmoring man and firejailing less is to blame. Now what's to be done about it so the unassuming firejail Ubuntu user can view man-pages again?

@btittelbach commented on GitHub (Oct 1, 2018): It works as expected even without rebooting. ``` % export PAGER=/usr/local/bin/less % sudo aa-disable /usr/bin/man Disabling /usr/bin/man. % man test % sudo aa-enforce /usr/bin/man Setting /usr/bin/man to enforce mode. % man test Error clone: main.c:2517 main: Operation not permitted man: command exited with status 1: sed -e '/^[[:space:]]*$/{ N; /^[[:space:]]*\n[[:space:]]*$/D; }' | LESS=-ix8RmPm Manual page test(1) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$PM Manual page test(1) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$ MAN_PN=test(1) /usr/local/bin/less ``` So we know the double-sandboxing in Ubuntu of AppArmoring `man` and firejailing `less` is to blame. Now what's to be done about it so the unassuming firejail Ubuntu user can view `man`-pages again?

gitea-mirror commented

2026-05-05 08:06:22 -06:00

Author

Owner

@Vincent43 commented on GitHub (Oct 1, 2018):

It's generally known that AppArmor can break firejail if specific app use both at the same time. We had already reports about libreoffice and thunderbird affected by this on Ubuntu. My advice is to disable one of them for the specific app. I don't know what else we can do.

@Vincent43 commented on GitHub (Oct 1, 2018): It's generally known that AppArmor can break firejail if specific app use both at the same time. We had already reports about libreoffice and thunderbird affected by this on Ubuntu. My advice is to disable one of them for the specific app. I don't know what else we can do.

gitea-mirror commented

2026-05-05 08:06:23 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 29, 2019):

Since there isn't really much we can do, the culprit/problem has been found, and the issue has been inactive for a while, I'm going to mark this with "workaround" and close it for now. @btittelbach, please feel free to re-open it if you have more questions.

@chiraag-nataraj commented on GitHub (May 29, 2019): Since there isn't _really_ much we can do, the culprit/problem has been found, and the issue has been inactive for a while, I'm going to mark this with "workaround" and close it for now. @btittelbach, please feel free to re-open it if you have more questions.

Rows
Columns

[GH-ISSUE #2121] man-pages not readable while less firejailed and man app-armored #1439