github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2207] private-bin broken in weird case #1479

New issue

Closed

opened 2026-05-05 08:08:36 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 08:08:36 -06:00

Owner

Originally created by @chiraag-nataraj on GitHub (Oct 20, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2207

I will investigate more, but here is the scenario I ran into this:
I'm using Viber with private-lib. One of the libraries it asks for is qt5, so that gets copied recursively. Qt bundles qmake etc with it within the /usr/lib/x86_64-linux-gnu/qt5/ subdirectory, so that also gets copied. However, since that qmake is a symbolic link to /usr/bin/<blah>-qmake, firejail follows that symlink. When I don't list those binaries in private-bin, though, firejail fails with:

Error stat: main.c:269 walk_directory: No such file or directory
Error: failed to run /run/firejail/lib/fldd
Error: proc 20119 cannot sync with peer: unexpected EOF
Peer 20121 unexpectedly exited with status 1

I thought this was introduced recently, but even the distro version (currently on 0.9.56) has the same issue, suggesting it's been there longer than I realized. The weird thing is that viber definitely was working earlier, so the only thing I can think of that might have caused this is an upgrade of Qt5.

Originally created by @chiraag-nataraj on GitHub (Oct 20, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2207 I will investigate more, but here is the scenario I ran into this: I'm using Viber with `private-lib`. One of the libraries it asks for is `qt5`, so that gets copied recursively. Qt bundles `qmake` etc with it _within the `/usr/lib/x86_64-linux-gnu/qt5/` subdirectory_, so that also gets copied. However, since that `qmake` is a symbolic link to `/usr/bin/<blah>-qmake`, `firejail` follows that symlink. When I don't list those binaries in `private-bin`, though, `firejail` fails with: ``` Error stat: main.c:269 walk_directory: No such file or directory Error: failed to run /run/firejail/lib/fldd Error: proc 20119 cannot sync with peer: unexpected EOF Peer 20121 unexpectedly exited with status 1 ``` I thought this was introduced recently, but even the distro version (currently on 0.9.56) has the same issue, suggesting it's been there longer than I realized. The weird thing is that `viber` definitely was working earlier, so the only thing I can think of that might have caused this is an upgrade of Qt5.

gitea-mirror closed this issue

2026-05-05 08:08:37 -06:00

gitea-mirror commented

2026-05-05 08:08:39 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Oct 20, 2018):

Potentially related, iirc Viber is no longer developing the Linux client and it is built against like Ubuntu 14.04 or something.

@SkewedZeppelin commented on GitHub (Oct 20, 2018): Potentially related, iirc Viber is no longer developing the Linux client and it is built against like Ubuntu 14.04 or something.

gitea-mirror commented

2026-05-05 08:08:40 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Oct 20, 2018):

Yeah it shows (they base it on libssl1.0-0, for example). But I didn't have any troubles at all until recently. It seems like the problem is that soemthing in private-lib pulls in /usr/lib/x86_64-linux-gnu/qt5, which then starts the whole mess. I guess the question is what should happen if something in private-lib links to something in */bin (as qt5 egregiously does) which isn't whitelisted in private-bin.

@chiraag-nataraj commented on GitHub (Oct 20, 2018): Yeah it shows (they base it on `libssl1.0-0`, for example). But I didn't have any troubles at all until recently. It seems like the problem is that soemthing in `private-lib` pulls in `/usr/lib/x86_64-linux-gnu/qt5`, which then starts the whole mess. I guess the question is what should happen if something in `private-lib` links to something in `*/bin` (as `qt5` egregiously does) which isn't whitelisted in `private-bin`.

gitea-mirror commented

2026-05-05 08:08:41 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Oct 20, 2018):

Getting rid of the offending Qt5 packages seemed to fix this particular bug (so my viber works properly now). But we should probably still figure out how to handle this kind of thing.

@chiraag-nataraj commented on GitHub (Oct 20, 2018): Getting rid of the offending Qt5 packages seemed to fix this particular bug (so my `viber` works properly now). But we should probably still figure out how to handle this kind of thing.

gitea-mirror commented

2026-05-05 08:08:43 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Oct 25, 2018):

From what I can tell, this has to do more with Qt5 putting symlinks to /usr/bin/ in /usr/lib, which, when copied by firejail (and when those binaries aren't whitelisted in private-bin), will throw an error.

@chiraag-nataraj commented on GitHub (Oct 25, 2018): From what I can tell, this has to do more with Qt5 putting symlinks to `/usr/bin/` in `/usr/lib`, which, when copied by `firejail` (and when those binaries aren't whitelisted in `private-bin`), will throw an error.

gitea-mirror commented

2026-05-05 08:08:43 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Aug 1, 2019):

Getting this error with gedit under openSUSE Tumbleweed
with private-lib enabled and private-bin commented it fails
but with private-bin uncommented it works

@SkewedZeppelin commented on GitHub (Aug 1, 2019): Getting this error with gedit under openSUSE Tumbleweed with private-lib enabled and private-bin commented it fails but with private-bin uncommented it works

gitea-mirror commented

2026-05-05 08:08:44 -06:00

Author

Owner

@ghost commented on GitHub (Jan 20, 2020):

Closing this, should be fixed via a02d12224b.

@ghost commented on GitHub (Jan 20, 2020): Closing this, should be fixed via https://github.com/netblue30/firejail/commit/a02d12224be9e170816a03eb61737f9e77be24ac.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1479

No description provided.

Rows
Columns