mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #2302] Qutebrowser 1.5.2 (latest) not working with seccomp.drop name_to_handle_at #1535
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1535
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @D-Nice on GitHub (Dec 18, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2302
After having updated all packages on my distro (void linux), I noticed qutebrowser would start, seemingly hang for 10 seconds, and then close.
Removing name_to_handle_at from the default profile, under seccomp.drop got qutebrowser working for me again without issues. Please let me know if there's any further information needed, to properly diagnose this issue.
Versions:
@D-Nice commented on GitHub (Dec 18, 2018):
a quick addendum also is that init_module and delete_module were identified as missing and bad by the firejail audit, and I've added those in, without any noticeable issues so far.
@rusty-snake commented on GitHub (Jun 26, 2019):
@D-Nice to confirm:
works:
didn't work:
seccomp@D-Nice commented on GitHub (Jun 26, 2019):
qutebrowser won't start with either of those.
With the seccomp filter for the most recent default profile I have, qutebrowser starts, but no page ever loads.
seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmspliceprofile I've been using
@rusty-snake commented on GitHub (Jun 26, 2019):
Work the following? (rm chroot)
Only
name_to_handle_at,chroot,init_moduleanddelete_moduleare loggen in syslog?@D-Nice commented on GitHub (Jun 28, 2019):
Latest doesn't work.
I don't have a syslogger on my void install.
@rusty-snake commented on GitHub (Jun 29, 2019):
How do you did that then?
@f4814 commented on GitHub (Jul 3, 2019):
My qutebrowser (1.6.2) also does not work with
seccompandtracelogenabled.(None of the fixes @rusty-snake can fix the default profile, only completely disabling this options works)
When I run qutebrowser with
-l debugit spits out:@D-Nice are you getting similar errors, or are we talking about a different issue entirely?
(OS: Gentoo, Firejail version: 0.9.50, qutebrowser: 1.6.3)
@rusty-snake commented on GitHub (Jul 3, 2019):
@f4814 if you have systemd, is there anything relatet in the journal (
sudo journalctl | grep syscall). Or if you have another syslog then there?If this isn't typo then this version is realy outdated.
@rusty-snake commented on GitHub (Jul 3, 2019):
#2669 works
env=QTWEBENGINE_DISABLE_SANDBOX=1?@f4814 commented on GitHub (Jul 4, 2019):
@rusty-snake It is the current stable version in the gentoo repository. But yes it is very outdated.
I switched to the current testing version and everything works like a charm now. Sorry to bother you.
@rusty-snake commented on GitHub (Jul 4, 2019):
There was two fixes on the profiel in the last year: #2087,
ca3964fe.@D-Nice can you confirm that it works with the lastet version.
@D-Nice commented on GitHub (Jul 5, 2019):
I'll see to give it a try when I can and report back
@D-Nice commented on GitHub (Jul 5, 2019):
At that point it worked with a partially edited seccomp filter. An update since has rendered the seccomp filter unusable for me.
I'm already using the latest, 0.9.60 firejail. I've also tried adding the env variable to the default profile, pages still fail to load.
I am getting an eventual crash with the following locked right after it:
The zygote errors I get even with seccomp disabled so that should not be the culprit.
Debug log of qutebrowser when trying to load a page with default profile
@rusty-snake commented on GitHub (Jul 6, 2019):
@D-Nice for me it also works. Using firejail from git. Don't know which version @f4814 mean with "current testing".
--env=VAR=VALUEon the commandlineenv VAR=VALUEin profilesI posted a mixup.
Maybe it is a void specific issue.
@D-Nice commented on GitHub (Jul 9, 2019):
it may very well be, or to do with my own qutebrowser config if it works for you. I will try and find some time in the coming weeks, to try on a different distro (clean config then my qt config) and a clean void install just to report back. I'll close this for now.
@q3cpma commented on GitHub (Jan 3, 2020):
Same problem here on Gentoo with firejail 0.9.62 and qutebrowser 1.8.3, I had to whitelist the
name_to_handle_atsyscall to solve it.@D-Nice commented on GitHub (Jan 24, 2020):
Thanks for the includion via
d626fa96e8Latest release is still missing it though, so I had to manually add it after the recent update. A hotfix release would be useful when possible!