[GH-ISSUE #2325] chromium: segfault due to "Check failed: ChrootToSafeEmptyDir()" #1553

New issue

Closed

opened 2026-05-05 08:12:54 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 08:12:54 -06:00

Owner

Originally created by @probonopd on GitHub (Jan 1, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2325

Getting a segfault when trying to run some Chromium for WebEngine based AppImages with Firejail, directly after Check failed: ChrootToSafeEmptyDir().

References:

Originally created by @probonopd on GitHub (Jan 1, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2325 Getting a segfault when trying to run some Chromium for WebEngine based AppImages with Firejail, directly after `Check failed: ChrootToSafeEmptyDir().` References: - https://github.com/martinrotter/rssguard/issues/151#issuecomment-338474062 - https://github.com/netblue30/firejail/issues/958 - https://github.com/netblue30/firejail/issues/1306

gitea-mirror closed this issue

2026-05-05 08:12:55 -06:00

gitea-mirror commented

2026-05-05 08:12:56 -06:00

Author

Owner

@smitsohu commented on GitHub (Jan 15, 2019):

Up to version 0.9.56, Firejail enforces a seccomp filter for appimages. The problem is this default seccomp filter and the internal QtWebengine sandbox don't play nice with each other, at least when unprivileged user namespaces are enabled (as is the case in Ubuntu and Fedora).

There are already some commits in Firejail master that should fix this issue. f74fa71cf9 by @crass is the primary fix.

In general however, this also means that apps with QtWebengine don't work with the default profile in the moment. They need their own profile with a seccomp filter that doesn't drop the chroot syscall, see the Qutebrowser profile for comparison ae3db84128/etc/qutebrowser.profile (L44)

@smitsohu commented on GitHub (Jan 15, 2019): Up to version 0.9.56, Firejail enforces a seccomp filter for appimages. The problem is this default seccomp filter and the internal QtWebengine sandbox don't play nice with each other, at least when unprivileged user namespaces are enabled (as is the case in Ubuntu and Fedora). There are already some commits in Firejail master that should fix this issue. f74fa71cf9d549b1607ca5b0c9fb2442e31f72ab by @crass is the primary fix. In general however, this also means that apps with QtWebengine don't work with the default profile in the moment. They need their own profile with a seccomp filter that doesn't drop the chroot syscall, see the Qutebrowser profile for comparison https://github.com/netblue30/firejail/blob/ae3db84128503c16fd638b5c7bf9408d64ce14ba/etc/qutebrowser.profile#L44

gitea-mirror commented

2026-05-05 08:12:57 -06:00

Author

Owner

@smitsohu commented on GitHub (Jan 30, 2019):

We believe this has been fixed in 0.9.58. Closing the issue.

@smitsohu commented on GitHub (Jan 30, 2019): We believe this has been fixed in 0.9.58. Closing the issue.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1553

No description provided.

Rows
Columns